@usex/mikrotik-mcp 4.24.0 → 5.0.0

package/dist/cli.js

@@ -3,13 +3,17 @@
 import {
   AAA_ENTITIES,
   ALWAYS_ON_MODULES,
+  AlertEngine,
+  AlertRuleSchema,
   Cmd,
   DEFAULT_CONFIG_HISTORY_DIR,
   DEFAULT_SNAPSHOT_DB,
   DEFAULT_TZSP_PORT,
   DeviceConfigSchema,
+  JobSchema,
   LOGO_URL,
   MikrotikConfigSchema,
+  NARRATIVE_SECTIONS,
   PKG_META,
   PROJECT_ROOT,
   PROMPTS_DIR,
@@ -25,17 +29,24 @@ import {
   addAaaEntity,
   allToolModules,
   allowDevice,
+  analyzeDevice,
   analyzeDrift,
   applyWritesSafely,
+  armJob,
+  attackStore,
   attributeChanges,
+  auditAdapter,
   backupDir,
   blockDevice,
   buildChangePlan,
   buildChannelPlanCommands,
   buildFtCommands,
+  buildGuards,
   buildHaCommands,
   buildLoadBalanceCommands,
+  buildModel,
   buildSteerCommands,
+  buildTopology,
   capsmanOverview,
   capture,
   captureSnapshot,
@@ -45,35 +56,73 @@ import {
   closeMemoryStore,
   commandUnsupported,
   configureRecorder,
+  conversations,
   createContext,
   createDeviceClient,
+  createDeviceExecutor,
+  createDeviceExecutor1 as createDeviceExecutor2,
   createLocalBackup,
+  currentPolicySet,
+  decide,
   deleteBackup,
+  deliver,
+  describeCron,
+  describeDiff,
   describeTransport,
   deviceDirectory,
   deviceLabels,
   devicesView,
+  diffFindings,
   diffLines,
+  diffNarratives,
+  diffTraces,
+  dropRollout,
+  dropTxn,
+  evaluatePolicies,
+  eventMet,
   executeMikrotikCommand,
+  executePlan,
+  explainUnmet,
   fetchAllReleases,
   fetchCapsmanState,
   fetchDevices,
   fetchLatestRelease,
+  flowStore,
+  forgetJob,
+  getAlertEngine,
+  getCapabilities,
   getConfig,
   getConfigSource,
+  getDeviceHistory,
+  getDeviceNeighbors,
+  getDeviceStatus,
   getEventStore,
+  getFlowCollector,
   getMemoryStore,
   getRadiusIncoming,
+  getRollout,
   getS3Client,
+  getTxn,
   getUmSettings,
   haGuidance,
+  initialState,
+  invalidateCapabilities,
   isEmpty,
+  isEventTrigger,
   isMacTelnetDevice,
+  isMuted,
+  isNeverBlock,
+  isPlan,
   isPoolEnabled,
   isS3Configured,
   listAaaEntity,
   listBackups,
   listDevices,
+  listRollouts,
+  listTxns,
+  liveExecutor,
+  liveRolloutUpdates,
+  liveTxnUpdates,
   loadBalancePlan,
   loadConfig,
   loadFileCacheSync,
@@ -81,51 +130,107 @@ import {
   looksLikeError,
   makeDeviceStatic,
   moduleCatalog,
+  neverBlockSet,
+  nextRun,
+  nextRunOf,
   normalizeExport,
+  noteDriftResult,
   openSnapshotStore,
-  parseDisks,
-  parseKeyValues,
+  parseDuration,
+  parseExport,
   parseLeadingNumber,
   parseRecords,
   parseRouterosDate,
+  parseRules,
   parseSize,
-  parseSystemResource,
+  peekCapabilities,
+  persistRollout,
+  persistTxn,
+  policyFromConfig,
   poolStatus,
   presignExpiresIn,
+  primeRiskIndex,
+  probeDevice,
+  protocolMix,
+  publishRollout,
   readBackup,
   redact,
+  redactChannels,
   registerTools,
   registerUiResources,
+  rememberReport,
   removeAaaEntity,
   removeDeviceLease,
   renameBackup,
+  renderDiff,
+  renderNarrative,
   renderPlan,
+  renderReport,
   reopenMemoryStore,
   reportWeakClients,
+  requestAbort,
+  requestAbort1 as requestAbort2,
+  requestHold,
   resetRadiusCounters,
   resolveDeviceName,
   restoreLocalBackup,
+  resume,
+  revokeBlock,
   riskOf,
+  rolloutStore,
+  ruleWarnings,
   runCapsmanAudit,
+  runJob,
+  runRollout,
+  runTransaction,
+  runnerOptions,
   s3Target,
   sampleAllTraffic,
   sampleDeviceTraffic,
+  schedulableTools,
+  scheduleStore,
   selectToolModules,
+  serializeCapabilities,
+  setAlertEngine,
   setConfig,
   setDeviceIp,
   setDeviceLabel,
   setDeviceLimits,
+  setMcpAlertSender,
   setRadiusIncoming,
   setUmSettings,
+  severityCounts,
   splitCommands,
+  startAttackDetection,
+  startHealthChecks,
+  startScheduler,
   steerAlreadyPresent,
+  step,
+  stopAttackDetection,
+  stopHealthChecks,
+  stopScheduler,
   subscribe,
+  subscribeRollout,
+  subscribeTxn,
   subscriberCount,
+  summarize,
+  summarize1 as summarize2,
+  sweep,
+  timeline,
+  toRecord,
+  toRecord1 as toRecord2,
   toggleAaaEntity,
+  topTalkers,
+  topologyMermaid,
+  tracePacket,
+  txnStore,
+  unreachableRules,
   updateAaaEntity,
   updateSummaryLine,
+  validatePolicyText,
+  worstSeverity,
   writeBackup
-} from "./shared/cli-10wtq3xb.js";
+} from "./shared/cli-2dj736ma.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -134,11 +239,23 @@ import { existsSync as existsSync2 } from "fs";
 import { spawn } from "child_process";
 import { readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3, networkInterfaces } from "os";
-import { dirname as dirname5, join as join4 } from "path";
+import { dirname as dirname7, join as join4 } from "path";
 var {serve } = globalThis.Bun;
 import { z as z2 } from "zod";
 
 // src/observability/modules.ts
+function unsupportedDevices(requires) {
+  const out = [];
+  for (const name of Object.keys(getConfig().devices)) {
+    const caps = peekCapabilities(name);
+    if (!caps)
+      continue;
+    const reason = explainUnmet(caps, requires);
+    if (reason)
+      out.push({ device: name, reason });
+  }
+  return out;
+}
 var lcSet = (xs) => new Set((xs ?? []).map((s) => s.toLowerCase()));
 function isModuleEnabled(filter, slug, group) {
   const enabledModules = lcSet(filter.enabledModules);
@@ -157,14 +274,19 @@ function isModuleEnabled(filter, slug, group) {
   return true;
 }
 function moduleSurface(filter, catalog = moduleCatalog) {
-  const modules = catalog.map((m) => ({
-    slug: m.slug,
-    label: m.label,
-    group: m.group,
-    description: m.description,
-    toolCount: m.tools.length,
-    enabled: isModuleEnabled(filter, m.slug, m.group)
-  }));
+  const modules = catalog.map((m) => {
+    const requires = m.tools.find((t) => t.requires)?.requires;
+    const unsupported = requires ? unsupportedDevices(requires) : [];
+    return {
+      slug: m.slug,
+      label: m.label,
+      group: m.group,
+      description: m.description,
+      toolCount: m.tools.length,
+      enabled: isModuleEnabled(filter, m.slug, m.group),
+      ...unsupported.length > 0 ? { unsupported } : {}
+    };
+  });
   const hasAllowList = (filter.enabledModules?.length ?? 0) > 0 || (filter.enabledGroups?.length ?? 0) > 0;
   return {
     modules,
@@ -532,297 +654,13 @@ function registerPrompts(server, opts = {}) {
   return count;
 }
 
-// src/observability/topology.ts
-function normMac(mac) {
-  if (!mac)
-    return;
-  const hex = mac.replace(/[^0-9a-fA-F]/g, "").toUpperCase();
-  return hex.length ? hex : undefined;
-}
-function parseNeighbors(text) {
-  const { rows } = parseRecords(text);
-  const out = [];
-  for (const r of rows) {
-    const n = {
-      interface: r.interface || r["interface-name"] || undefined,
-      ip: r.address || r.address4 || undefined,
-      ipv6: r.address6 || undefined,
-      mac: r["mac-address"] || undefined,
-      identity: r.identity || undefined,
-      platform: r.platform || undefined,
-      board: r.board || undefined,
-      version: r.version || undefined
-    };
-    if (n.mac || n.ip || n.identity)
-      out.push(n);
-  }
-  return out;
-}
-function suggestName(n, taken) {
-  const base = n.identity && n.identity.trim().replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || (normMac(n.mac) ? `device-${normMac(n.mac).slice(-6).toLowerCase()}` : "") || (n.ip ? `device-${n.ip.replace(/\./g, "-")}` : "device");
-  let name = base || "device";
-  let i = 2;
-  while (taken.has(name))
-    name = `${base}-${i++}`;
-  taken.add(name);
-  return name;
-}
-function buildTopology(input) {
-  const macToDevice = new Map;
-  const ipToDevice = new Map;
-  const identityToDevice = new Map;
-  const nodes = new Map;
-  for (const { name, config, status } of input.devices) {
-    nodes.set(name, {
-      id: name,
-      kind: "device",
-      label: status.identity || name,
-      configured: true,
-      onboardable: false,
-      identity: status.identity,
-      ip: config.host,
-      mac: config.mac,
-      platform: "MikroTik",
-      board: status.boardName,
-      version: status.version,
-      reachable: status.reachable,
-      cpuLoad: status.cpuLoad,
-      memUsedPct: status.memUsedPct,
-      uptime: status.uptime
-    });
-    const m = normMac(config.mac);
-    if (m)
-      macToDevice.set(m, name);
-    if (config.host)
-      ipToDevice.set(config.host, name);
-    if (status.identity)
-      identityToDevice.set(status.identity.toLowerCase(), name);
-    identityToDevice.set(name.toLowerCase(), name);
-  }
-  const matchConfigured = (n) => {
-    const m = normMac(n.mac);
-    if (m && macToDevice.has(m))
-      return macToDevice.get(m);
-    if (n.ip && ipToDevice.has(n.ip))
-      return ipToDevice.get(n.ip);
-    if (n.identity && identityToDevice.has(n.identity.toLowerCase())) {
-      return identityToDevice.get(n.identity.toLowerCase());
-    }
-    return;
-  };
-  const edges = [];
-  const edgeKeys = new Set;
-  const takenNames = new Set(input.devices.map((d) => d.name));
-  const addEdge = (from, to, iface) => {
-    if (from === to)
-      return;
-    const key = `${from}\x00${to}\x00${iface ?? ""}`;
-    if (edgeKeys.has(key))
-      return;
-    edgeKeys.add(key);
-    edges.push({ from, to, interface: iface });
-  };
-  const neighborId = (n) => {
-    const m = normMac(n.mac);
-    if (m)
-      return `nb:mac:${m}`;
-    if (n.identity)
-      return `nb:id:${n.identity.toLowerCase()}`;
-    return `nb:ip:${n.ip ?? "unknown"}`;
-  };
-  for (const { name } of input.devices) {
-    const seen = input.neighborsByDevice[name] ?? [];
-    for (const n of seen) {
-      const configuredId = matchConfigured(n);
-      if (configuredId) {
-        addEdge(name, configuredId, n.interface);
-        continue;
-      }
-      const id = neighborId(n);
-      const existing = nodes.get(id);
-      if (existing) {
-        existing.ip ??= n.ip;
-        existing.mac ??= n.mac;
-        existing.identity ??= n.identity;
-        existing.board ??= n.board;
-        existing.version ??= n.version;
-        if (!existing.label && n.identity)
-          existing.label = n.identity;
-      } else {
-        nodes.set(id, {
-          id,
-          kind: "neighbor",
-          label: n.identity || n.mac || n.ip || "unknown",
-          configured: false,
-          onboardable: true,
-          identity: n.identity,
-          ip: n.ip,
-          mac: n.mac,
-          platform: n.platform,
-          board: n.board,
-          version: n.version,
-          suggestedConfig: {
-            name: suggestName(n, takenNames),
-            host: n.ip,
-            mac: n.ip ? undefined : n.mac,
-            port: 22,
-            username: "admin"
-          }
-        });
-      }
-      addEdge(name, id, n.interface);
-    }
-  }
-  const nodeList = [...nodes.values()];
-  return {
-    nodes: nodeList,
-    edges,
-    stats: {
-      devices: input.devices.length,
-      neighbors: nodeList.filter((n) => n.kind === "neighbor").length,
-      onboardable: nodeList.filter((n) => n.onboardable).length
-    }
-  };
-}
-
-// src/observability/health.ts
-var LOG_TAG = "mikrotik-mcp";
-var HISTORY_CAP = 60;
-var statuses = new Map;
-var histories = new Map;
-var neighbors = new Map;
-var timer = null;
-var inFlight = false;
-var UNKNOWN = { reachable: null, checkedAt: null, latencyMs: null };
-function getDeviceStatus(name) {
-  return statuses.get(name) ?? UNKNOWN;
-}
-function getDeviceNeighbors(name) {
-  return neighbors.get(name) ?? [];
-}
-function getDeviceHistory(name) {
-  return histories.get(name) ?? [];
-}
-function pushHistory(name, sample) {
-  const arr = histories.get(name) ?? [];
-  arr.push(sample);
-  if (arr.length > HISTORY_CAP)
-    arr.splice(0, arr.length - HISTORY_CAP);
-  histories.set(name, arr);
-}
-async function probeDevice(name, dc) {
-  const client = createDeviceClient({
-    ...dc,
-    timeoutMs: Math.min(dc.timeoutMs ?? 1e4, 8000)
-  });
-  const t0 = Date.now();
-  let status;
-  try {
-    const ok = await client.connect();
-    if (!ok) {
-      status = {
-        reachable: false,
-        checkedAt: Date.now(),
-        latencyMs: null,
-        error: client.lastError ?? "connection failed"
-      };
-    } else {
-      const rawResource = await client.run("/system resource print");
-      const checkedAt = Date.now();
-      const latencyMs = checkedAt - t0;
-      const sys = parseSystemResource(rawResource);
-      if (!sys) {
-        logger.warn(`[${LOG_TAG}] '${name}' is reachable but '/system resource print' returned no ` + `parseable metrics. Raw output: ${JSON.stringify(rawResource.slice(0, 200))}`);
-      }
-      let identity;
-      try {
-        identity = parseKeyValues(await client.run("/system identity print")).name || undefined;
-      } catch {}
-      status = {
-        reachable: true,
-        checkedAt,
-        latencyMs,
-        identity,
-        version: sys?.version,
-        boardName: sys?.boardName,
-        architecture: sys?.architecture,
-        cpuCount: sys?.cpuCount,
-        cpuLoad: sys?.cpuLoad,
-        freeMemory: sys?.freeMemory,
-        totalMemory: sys?.totalMemory,
-        memUsedPct: sys?.memUsedPct,
-        freeHdd: sys?.freeHdd,
-        totalHdd: sys?.totalHdd,
-        hddUsedPct: sys?.hddUsedPct,
-        uptime: sys?.uptime,
-        error: sys ? undefined : "reachable, but no system metrics returned"
-      };
-      pushHistory(name, {
-        ts: checkedAt,
-        cpuLoad: sys?.cpuLoad ?? null,
-        memUsedPct: sys?.memUsedPct ?? null,
-        hddUsedPct: sys?.hddUsedPct ?? null,
-        latencyMs
-      });
-      try {
-        neighbors.set(name, parseNeighbors(await client.run("/ip neighbor print detail")));
-      } catch {}
-      try {
-        status.disks = parseDisks(await client.run("/disk print detail"));
-      } catch {}
-    }
-  } catch (e) {
-    status = {
-      reachable: false,
-      checkedAt: Date.now(),
-      latencyMs: null,
-      error: e instanceof Error ? e.message : String(e)
-    };
-  } finally {
-    client.disconnect();
-  }
-  statuses.set(name, status);
-  return status;
-}
-var MAC_PROBE_INTERVAL_MS = 5 * 60000;
-var lastMacProbe = new Map;
-async function probeAll() {
-  if (inFlight)
-    return;
-  inFlight = true;
-  try {
-    const cfg = getConfig();
-    const now = Date.now();
-    await Promise.all(Object.entries(cfg.devices).map(([name, dc]) => {
-      if (dc.mac) {
-        if (now - (lastMacProbe.get(name) ?? 0) < MAC_PROBE_INTERVAL_MS)
-          return Promise.resolve();
-        lastMacProbe.set(name, now);
-      }
-      return probeDevice(name, dc).catch(() => {});
-    }));
-  } finally {
-    inFlight = false;
-  }
-}
-function startHealthChecks(intervalMs = 30000) {
-  probeAll();
-  timer = setInterval(() => void probeAll(), intervalMs);
-}
-function stopHealthChecks() {
-  if (timer) {
-    clearInterval(timer);
-    timer = null;
-  }
-}
-
 // src/observability/geo.ts
 import { lookup } from "dns/promises";
-var LOG_TAG2 = "mikrotik-mcp";
+var LOG_TAG = "mikrotik-mcp";
 var cache = new Map;
 var REFRESH_MS = 24 * 60 * 60000;
-var timer2 = null;
-var inFlight2 = false;
+var timer = null;
+var inFlight = false;
 function getDeviceGeo(name) {
   return cache.get(name)?.geo ?? null;
 }
@@ -870,12 +708,12 @@ async function fetchGeo(ip) {
   try {
     return await fetchIpkit(ip);
   } catch (e) {
-    logger.warn(`[${LOG_TAG2}] ipkit geo failed for ${ip}, trying ipquery: ${e instanceof Error ? e.message : String(e)}`);
+    logger.warn(`[${LOG_TAG}] ipkit geo failed for ${ip}, trying ipquery: ${e instanceof Error ? e.message : String(e)}`);
   }
   try {
     return await fetchIpquery(ip);
   } catch (e) {
-    logger.warn(`[${LOG_TAG2}] geo lookup failed for ${ip}: ${e instanceof Error ? e.message : String(e)}`);
+    logger.warn(`[${LOG_TAG}] geo lookup failed for ${ip}: ${e instanceof Error ? e.message : String(e)}`);
     return null;
   }
 }
@@ -885,9 +723,9 @@ async function resolveDevice(name, host) {
   cache.set(name, { geo, at: Date.now() });
 }
 async function refreshGeo() {
-  if (inFlight2)
+  if (inFlight)
     return;
-  inFlight2 = true;
+  inFlight = true;
   try {
     const now = Date.now();
     await Promise.all(Object.entries(getConfig().devices).map(([name, dc]) => {
@@ -897,17 +735,17 @@ async function refreshGeo() {
       return resolveDevice(name, dc.mac ? undefined : dc.host);
     }));
   } finally {
-    inFlight2 = false;
+    inFlight = false;
   }
 }
 function startGeoLookups() {
   refreshGeo();
-  timer2 = setInterval(() => void refreshGeo(), REFRESH_MS);
+  timer = setInterval(() => void refreshGeo(), REFRESH_MS);
 }
 function stopGeoLookups() {
-  if (timer2) {
-    clearInterval(timer2);
-    timer2 = null;
+  if (timer) {
+    clearInterval(timer);
+    timer = null;
   }
 }
 
@@ -915,7 +753,7 @@ function stopGeoLookups() {
 import { join as join3 } from "path";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir } from "os";
-var LOG_TAG3 = "mikrotik-mcp";
+var LOG_TAG2 = "mikrotik-mcp";
 var CODE_RE = /^[a-z]{2}$/;
 var sourceUrl = (code) => `https://hatscripts.github.io/circle-flags/flags/${code}.svg`;
 var VENDOR_DIR = join3(PROJECT_ROOT, "assets", "flags");
@@ -947,7 +785,7 @@ async function flagSvg(code) {
     mkdir(CACHE_DIR, { recursive: true }).then(() => writeFile(join3(CACHE_DIR, `${c}.svg`), svg)).catch(() => {});
     return svg;
   } catch (e) {
-    logger.warn(`[${LOG_TAG3}] flag fetch failed for '${c}': ${e instanceof Error ? e.message : String(e)}`);
+    logger.warn(`[${LOG_TAG2}] flag fetch failed for '${c}': ${e instanceof Error ? e.message : String(e)}`);
     return null;
   }
 }
@@ -1010,6 +848,8 @@ function rowToEvent(r) {
     risk: r.risk,
     device: r.device ?? undefined,
     transport: r.transport ?? undefined,
+    deviceTransport: r.device_transport ?? undefined,
+    restFallback: r.rest_fallback ?? undefined,
     durationMs: r.duration_ms,
     isError: r.is_error === 1,
     error: r.error ?? undefined,
@@ -1038,13 +878,19 @@ var SCHEMA_STATEMENTS = [
      output_bytes INTEGER NOT NULL,
      has_structured INTEGER NOT NULL,
      truncated INTEGER NOT NULL,
-     reason TEXT
+     reason TEXT,
+     device_transport TEXT,
+     rest_fallback TEXT
    )`,
   "CREATE INDEX IF NOT EXISTS idx_events_ts ON events(ts)",
   "CREATE INDEX IF NOT EXISTS idx_events_tool ON events(tool)",
   "CREATE INDEX IF NOT EXISTS idx_events_error ON events(is_error)"
 ];
-var MIGRATIONS = ["ALTER TABLE events ADD COLUMN reason TEXT"];
+var MIGRATIONS = [
+  "ALTER TABLE events ADD COLUMN reason TEXT",
+  "ALTER TABLE events ADD COLUMN device_transport TEXT",
+  "ALTER TABLE events ADD COLUMN rest_fallback TEXT"
+];
 
 class SqliteEventStore {
   db;
@@ -1062,9 +908,11 @@ class SqliteEventStore {
   }
   insert(e) {
     this.db.query(`INSERT OR REPLACE INTO events
-         (id, ts, tool, title, risk, device, transport, duration_ms, is_error, error,
+         (id, ts, tool, title, risk, device, transport, device_transport, rest_fallback,
+          duration_ms, is_error, error,
           input, output, output_bytes, has_structured, truncated, reason)
-         VALUES ($id,$ts,$tool,$title,$risk,$device,$transport,$dur,$err,$errmsg,
+         VALUES ($id,$ts,$tool,$title,$risk,$device,$transport,$devtransport,$restfallback,
+                 $dur,$err,$errmsg,
           $input,$output,$obytes,$structured,$trunc,$reason)`).run({
       $id: e.id,
       $ts: e.ts,
@@ -1073,6 +921,8 @@ class SqliteEventStore {
       $risk: e.risk,
       $device: e.device ?? null,
       $transport: e.transport ?? null,
+      $devtransport: e.deviceTransport ?? null,
+      $restfallback: e.restFallback ?? null,
       $dur: e.durationMs,
       $err: e.isError ? 1 : 0,
       $errmsg: e.error ?? null,
@@ -1277,8 +1127,8 @@ var CAPSMAN_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 var DEFAULT_CAPSMAN_INTERVAL_MS = 5 * 60000;
 var MIN_CAPSMAN_INTERVAL_MS = 60000;
 var MAX_CAPSMAN_INTERVAL_MS = 6 * 60 * 60000;
-var timer3 = null;
-var inFlight3 = false;
+var timer2 = null;
+var inFlight2 = false;
 var noCapsman = new Set;
 function clampInterval(ms) {
   if (!Number.isFinite(ms))
@@ -1305,9 +1155,9 @@ async function sampleDevice(store, device, ts) {
   store.recordRadioSamples(device, ts, samples);
 }
 async function sampleCapsmanOnce(store) {
-  if (inFlight3)
+  if (inFlight2)
     return;
-  inFlight3 = true;
+  inFlight2 = true;
   const ts = Date.now();
   try {
     const cfg = getConfig();
@@ -1322,18 +1172,18 @@ async function sampleCapsmanOnce(store) {
     }));
     store.pruneSamples(ts - CAPSMAN_RETENTION_MS);
   } finally {
-    inFlight3 = false;
+    inFlight2 = false;
   }
 }
 function startCapsmanSampler(store, intervalMs = DEFAULT_CAPSMAN_INTERVAL_MS) {
   const ms = clampInterval(intervalMs);
   sampleCapsmanOnce(store);
-  timer3 = setInterval(() => void sampleCapsmanOnce(store), ms);
+  timer2 = setInterval(() => void sampleCapsmanOnce(store), ms);
 }
 function stopCapsmanSampler() {
-  if (timer3) {
-    clearInterval(timer3);
-    timer3 = null;
+  if (timer2) {
+    clearInterval(timer2);
+    timer2 = null;
   }
 }
 
@@ -1473,8 +1323,8 @@ var USAGE_RETENTION_MS = 93 * 24 * 60 * 60 * 1000;
 var DEFAULT_USAGE_INTERVAL_MS = 60000;
 var MIN_USAGE_INTERVAL_MS = 30000;
 var MAX_USAGE_INTERVAL_MS = 6 * 60 * 60000;
-var timer4 = null;
-var inFlight4 = false;
+var timer3 = null;
+var inFlight3 = false;
 var currentStore = null;
 var currentIntervalMs = DEFAULT_USAGE_INTERVAL_MS;
 function clampInterval2(ms) {
@@ -1535,9 +1385,9 @@ async function ingestSessions(store, device) {
   store.upsertSessions(device, sessions);
 }
 async function sampleUsageOnce(store) {
-  if (inFlight4)
+  if (inFlight3)
     return;
-  inFlight4 = true;
+  inFlight3 = true;
   const ts = Date.now();
   try {
     const cfg = getConfig();
@@ -1553,32 +1403,32 @@ async function sampleUsageOnce(store) {
     }));
     store.pruneSamples(ts - USAGE_RETENTION_MS);
   } finally {
-    inFlight4 = false;
+    inFlight3 = false;
   }
 }
 function startUsageSampler(store, intervalMs = DEFAULT_USAGE_INTERVAL_MS) {
   currentStore = store;
   currentIntervalMs = clampInterval2(intervalMs);
   sampleUsageOnce(store);
-  timer4 = setInterval(() => void sampleUsageOnce(store), currentIntervalMs);
+  timer3 = setInterval(() => void sampleUsageOnce(store), currentIntervalMs);
 }
 function getUsageSamplerInterval() {
   return currentIntervalMs;
 }
 function setUsageSamplerInterval(intervalMs) {
   currentIntervalMs = clampInterval2(intervalMs);
-  if (timer4)
-    clearInterval(timer4);
+  if (timer3)
+    clearInterval(timer3);
   if (currentStore) {
     const store = currentStore;
-    timer4 = setInterval(() => void sampleUsageOnce(store), currentIntervalMs);
+    timer3 = setInterval(() => void sampleUsageOnce(store), currentIntervalMs);
   }
   return currentIntervalMs;
 }
 function stopUsageSampler() {
-  if (timer4) {
-    clearInterval(timer4);
-    timer4 = null;
+  if (timer3) {
+    clearInterval(timer3);
+    timer3 = null;
   }
   currentStore = null;
 }
@@ -1822,6 +1672,7 @@ async function driftRoutes(req, url) {
         toLabel: `${device}@live`
       });
       const report = analyzeDrift(diff, device, baseline.snapshotId, baseline.setAt);
+      noteDriftResult(report);
       try {
         const logCmd = `/log print where topics~"system" and time > ([:timestamp] - 7d)`;
         const logText = await executeMikrotikCommand(logCmd, ctx);
@@ -1837,12 +1688,1261 @@ async function driftRoutes(req, url) {
   return null;
 }
 
-// src/observability/memory-routes.ts
+// src/observability/txn-routes.ts
 var JSON_HEADERS2 = { "content-type": "application/json; charset=utf-8" };
 function json2(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
 }
+function liveRecord(id) {
+  const entry = getTxn(id);
+  return entry ? { ...toRecord(entry.txn, entry.ts, entry.label), updated: Date.now() } : null;
+}
+async function txnRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/txn"))
+    return null;
+  let storeError;
+  const store = await txnStore().catch((e) => {
+    storeError = e instanceof Error ? e.message : String(e);
+    return null;
+  });
+  if (p === "/api/txn" && req.method === "GET") {
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    const stored = store?.list(limit) ?? [];
+    const live = listTxns().map((e) => ({
+      ...toRecord(e.txn, e.ts, e.label),
+      updated: Date.now()
+    }));
+    const byId = new Map(stored.map((r) => [r.id, r]));
+    for (const r of live)
+      byId.set(r.id, r);
+    const transactions = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
+    return json2({ transactions, live: liveTxnUpdates(), error: storeError });
+  }
+  const parts = p.slice("/api/txn/".length).split("/").filter(Boolean);
+  if (parts.length === 0 || parts.length > 2)
+    return json2({ error: "not found" }, 404);
+  const id = decodeURIComponent(parts[0]);
+  if (parts[1] === "abort" && req.method === "POST") {
+    const entry = getTxn(id);
+    if (!entry)
+      return json2({ error: `no open transaction '${id}'` }, 404);
+    entry.txn = requestAbort(entry.txn, "aborted from the dashboard");
+    const run = await runTransaction({
+      txn: entry.txn,
+      steps: entry.steps,
+      executor: createDeviceExecutor(createContext(), entry.txn.id)
+    });
+    entry.txn = run.txn;
+    await persistTxn(entry);
+    if (run.state !== undefined)
+      dropTxn(id);
+    return json2({
+      state: run.state,
+      summary: run.summary,
+      transaction: toRecord(run.txn, entry.ts)
+    });
+  }
+  if (parts.length === 1 && req.method === "GET") {
+    const record = liveRecord(id) ?? store?.get(id) ?? null;
+    if (!record)
+      return json2({ error: `unknown transaction '${id}'` }, 404);
+    return json2({ transaction: record, events: store?.events(id) ?? [] });
+  }
+  return json2({ error: "method not allowed" }, 405);
+}
+
+// src/observability/flow-routes.ts
+var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
+function json3(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
+}
+var WINDOWS = {
+  "5m": 5 * 60000,
+  "15m": 15 * 60000,
+  "1h": 3600000,
+  "6h": 6 * 3600000,
+  "24h": 24 * 3600000
+};
+function bucketFor(windowMs) {
+  return Math.max(60000, Math.round(windowMs / 60 / 60000) * 60000);
+}
+function windowMs(url) {
+  return WINDOWS[url.searchParams.get("window") ?? "1h"] ?? WINDOWS["1h"];
+}
+async function flowRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/flows"))
+    return null;
+  if (req.method !== "GET")
+    return json3({ error: "method not allowed" }, 405);
+  const collector = getFlowCollector();
+  if (p === "/api/flows/health") {
+    let store = null;
+    try {
+      store = (await flowStore()).stats();
+    } catch {}
+    return json3({ collector: collector.stats(), store });
+  }
+  collector.drain();
+  let records;
+  const span = windowMs(url);
+  const to = Date.now();
+  const from = to - span;
+  const address = url.searchParams.get("address") ?? undefined;
+  try {
+    records = (await flowStore()).query({ from, to, address, limit: 200000 });
+  } catch (e) {
+    return json3({ error: e instanceof Error ? e.message : String(e), records: [] }, 200);
+  }
+  if (p === "/api/flows/top") {
+    const dimension = url.searchParams.get("dimension") ?? "source";
+    const limit = Number(url.searchParams.get("limit") ?? 10);
+    return json3({
+      window: { from, to },
+      totals: summarize(records),
+      top: topTalkers(records, dimension, limit, true),
+      protocols: protocolMix(records).slice(0, 8),
+      applications: topTalkers(records, "application", 8, true)
+    });
+  }
+  if (p === "/api/flows/conversations") {
+    const limit = Number(url.searchParams.get("limit") ?? 20);
+    return json3({
+      window: { from, to },
+      conversations: conversations(records, limit)
+    });
+  }
+  if (p === "/api/flows/timeline") {
+    const dimension = url.searchParams.get("dimension") ?? "source";
+    const topN = Number(url.searchParams.get("topN") ?? 5);
+    const bucket = bucketFor(span);
+    return json3({
+      window: { from, to },
+      bucketMs: bucket,
+      keys: topTalkers(records, dimension, topN).map((t) => t.key),
+      buckets: timeline(records, from, to, bucket, dimension, topN)
+    });
+  }
+  return json3({ error: "not found" }, 404);
+}
+
+// src/observability/rollout-routes.ts
+var JSON_HEADERS4 = { "content-type": "application/json; charset=utf-8" };
+function json4(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS4 });
+}
+function liveRecord2(id) {
+  const entry = getRollout(id);
+  return entry ? {
+    ...toRecord2(entry.state, entry.ts, { label: entry.label, commands: entry.commands }),
+    updated: Date.now()
+  } : null;
+}
+async function rolloutRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/rollout"))
+    return null;
+  let storeError;
+  const store = await rolloutStore().catch((e) => {
+    storeError = e instanceof Error ? e.message : String(e);
+    return null;
+  });
+  if (p === "/api/rollout" && req.method === "GET") {
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    const stored = store?.list(limit) ?? [];
+    const live = listRollouts().map((e) => ({
+      ...toRecord2(e.state, e.ts, { label: e.label, commands: e.commands }),
+      updated: Date.now()
+    }));
+    const byId = new Map(stored.map((r) => [r.id, r]));
+    for (const r of live)
+      byId.set(r.id, r);
+    const rollouts = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
+    return json4({ rollouts, live: liveRolloutUpdates(), error: storeError });
+  }
+  const parts = p.slice("/api/rollout/".length).split("/").filter(Boolean);
+  if (parts.length === 0 || parts.length > 2)
+    return json4({ error: "not found" }, 404);
+  const id = decodeURIComponent(parts[0]);
+  const verb = parts[1];
+  if (verb && req.method === "POST") {
+    const entry = getRollout(id);
+    if (!entry)
+      return json4({ error: `no active rollout '${id}'` }, 404);
+    switch (verb) {
+      case "hold": {
+        entry.state = requestHold(entry.state);
+        await persistRollout(entry);
+        publishRollout({
+          rolloutId: id,
+          ts: Date.now(),
+          phase: entry.state.phase,
+          currentWave: entry.state.currentWave,
+          action: "hold",
+          ok: true,
+          devices: entry.state.devices,
+          gates: entry.state.gates
+        });
+        return json4({ held: true, summary: summarize2(entry.state) });
+      }
+      case "resume": {
+        entry.state = resume(entry.state);
+        const run = await runRollout({
+          state: entry.state,
+          commands: entry.commands,
+          executor: createDeviceExecutor2(createContext(), id),
+          onEvent: ({ action, state }) => {
+            entry.state = state;
+            publishRollout({
+              rolloutId: id,
+              ts: Date.now(),
+              phase: state.phase,
+              currentWave: state.currentWave,
+              action: action.kind,
+              device: "device" in action ? action.device : undefined,
+              ok: true,
+              outcome: state.outcome,
+              devices: state.devices,
+              gates: state.gates
+            });
+          }
+        });
+        entry.state = run.state;
+        await persistRollout(entry);
+        if (run.outcome)
+          dropRollout(id);
+        return json4({ outcome: run.outcome, summary: run.summary });
+      }
+      case "abort": {
+        entry.state = requestAbort2(entry.state, "aborted from the dashboard");
+        const run = await runRollout({
+          state: entry.state,
+          commands: entry.commands,
+          executor: createDeviceExecutor2(createContext(), id)
+        });
+        entry.state = run.state;
+        await persistRollout(entry);
+        if (run.outcome)
+          dropRollout(id);
+        return json4({ outcome: run.outcome, summary: run.summary });
+      }
+      default:
+        return json4({ error: `unknown action '${verb}'` }, 404);
+    }
+  }
+  if (parts.length === 1 && req.method === "GET") {
+    const record = liveRecord2(id) ?? store?.get(id) ?? null;
+    if (!record)
+      return json4({ error: `unknown rollout '${id}'` }, 404);
+    return json4({ rollout: record, events: store?.events(id) ?? [] });
+  }
+  return json4({ error: "method not allowed" }, 405);
+}
+
+// src/policy/results.ts
+import { mkdirSync as mkdirSync6 } from "fs";
+import { dirname as dirname5 } from "path";
+var SCHEMA_STATEMENTS4 = [
+  `CREATE TABLE IF NOT EXISTS policy_results (
+     id             INTEGER PRIMARY KEY AUTOINCREMENT,
+     device         TEXT NOT NULL,
+     ts             INTEGER NOT NULL,
+     score          INTEGER NOT NULL,
+     passed         INTEGER NOT NULL,
+     failed         INTEGER NOT NULL,
+     not_applicable INTEGER NOT NULL,
+     by_severity    TEXT NOT NULL,
+     findings       TEXT NOT NULL
+   )`,
+  "CREATE INDEX IF NOT EXISTS idx_policy_results_device_ts ON policy_results(device, ts)"
+];
+
+class SqlitePolicyResultStore {
+  db;
+  constructor(db) {
+    this.db = db;
+    db.run("PRAGMA journal_mode = WAL");
+    db.run("PRAGMA synchronous = NORMAL");
+    for (const stmt of SCHEMA_STATEMENTS4)
+      db.run(stmt);
+  }
+  insert(report) {
+    this.db.query(`INSERT INTO policy_results
+         (device, ts, score, passed, failed, not_applicable, by_severity, findings)
+         VALUES ($device,$ts,$score,$passed,$failed,$na,$bySeverity,$findings)`).run({
+      $device: report.device ?? "(snapshot)",
+      $ts: report.ts ?? Date.now(),
+      $score: report.summary.score,
+      $passed: report.summary.passed,
+      $failed: report.summary.failed,
+      $na: report.summary.notApplicable,
+      $bySeverity: JSON.stringify(report.summary.bySeverity),
+      $findings: JSON.stringify(report.findings.filter((f) => f.status === "fail"))
+    });
+  }
+  list(device, limit = 50) {
+    const rows = device ? this.db.query("SELECT * FROM policy_results WHERE device = $device ORDER BY ts DESC LIMIT $limit").all({ $device: device, $limit: limit }) : this.db.query("SELECT * FROM policy_results ORDER BY ts DESC LIMIT $limit").all({ $limit: limit });
+    return rows.map((r) => ({
+      id: r.id,
+      device: r.device,
+      ts: r.ts,
+      score: r.score,
+      passed: r.passed,
+      failed: r.failed,
+      notApplicable: r.not_applicable,
+      bySeverity: JSON.parse(r.by_severity),
+      findings: JSON.parse(r.findings)
+    }));
+  }
+  close() {
+    this.db.close();
+  }
+}
+async function openPolicyResultStore(path) {
+  if (path !== ":memory:") {
+    try {
+      mkdirSync6(dirname5(path), { recursive: true });
+    } catch {}
+  }
+  const { Database } = await import("bun:sqlite");
+  const db = new Database(path, { create: true });
+  return new SqlitePolicyResultStore(db);
+}
+var storePromise2 = null;
+function store() {
+  storePromise2 ??= openPolicyResultStore(DEFAULT_SNAPSHOT_DB);
+  return storePromise2;
+}
+async function recordPolicyResult(report) {
+  try {
+    (await store()).insert(report);
+  } catch (e) {
+    logger.error(`policy result write failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+}
+async function policyResults(device, limit = 50) {
+  return (await store()).list(device, limit);
+}
+
+// src/observability/policy-routes.ts
+var JSON_HEADERS5 = { "content-type": "application/json; charset=utf-8" };
+function json5(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS5 });
+}
 async function bodyJson2(req) {
+  return await req.json().catch(() => ({}));
+}
+async function policyRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/policies"))
+    return null;
+  if (p === "/api/policies" && req.method === "GET") {
+    const set = currentPolicySet();
+    return json5({
+      files: set.files.map((f) => ({
+        path: f.path,
+        name: f.name,
+        ok: f.ok,
+        issues: f.issues,
+        policies: f.policies
+      })),
+      ruleCount: set.policies.length,
+      duplicateIds: set.duplicateIds,
+      emptyPatterns: set.emptyPatterns,
+      paths: getConfig().policy.paths
+    });
+  }
+  if (p === "/api/policies/results" && req.method === "GET") {
+    const device = url.searchParams.get("device") ?? undefined;
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    let results;
+    try {
+      results = await policyResults(device, limit);
+    } catch (e) {
+      return json5({ results: [], error: e instanceof Error ? e.message : String(e) });
+    }
+    return json5({ results });
+  }
+  if (p === "/api/policies/validate" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    if (typeof body.content !== "string")
+      return json5({ error: "content is required" }, 400);
+    return json5(validatePolicyText(body.content));
+  }
+  if (p === "/api/policies/run" && req.method === "POST") {
+    const body = await bodyJson2(req);
+    const set = currentPolicySet();
+    if (set.policies.length === 0) {
+      return json5({ error: "no policy rules are loaded", reports: [] });
+    }
+    const cfg = getConfig();
+    const devices = body.devices && body.devices.length > 0 ? body.devices : Object.entries(cfg.devices).filter(([, d]) => !d.disabled).map(([name]) => name);
+    const reports = [];
+    for (const device of devices) {
+      const ctx = createContext(undefined, device);
+      try {
+        const text = await executeMikrotikCommand("/export terse", ctx);
+        if (looksLikeError(text) || text.trim() === "") {
+          reports.push({ device, error: text.trim() || "empty export" });
+          continue;
+        }
+        const report = evaluatePolicies(set.policies, parseExport(text), {
+          device,
+          ts: Date.now()
+        });
+        rememberReport(report);
+        await recordPolicyResult(report);
+        reports.push({
+          device,
+          summary: report.summary,
+          findings: report.findings,
+          markdown: renderReport(report, "markdown")
+        });
+      } catch (e) {
+        reports.push({ device, error: e instanceof Error ? e.message : String(e) });
+      }
+    }
+    return json5({ reports });
+  }
+  return json5({ error: "not found" }, 404);
+}
+
+// src/sim/suites.ts
+import { mkdirSync as mkdirSync7 } from "fs";
+import { dirname as dirname6 } from "path";
+var SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS sim_suites (
+     id      TEXT PRIMARY KEY,
+     name    TEXT NOT NULL,
+     packets TEXT NOT NULL,
+     updated INTEGER NOT NULL
+   )`
+];
+
+class SqliteSuiteStore {
+  db;
+  constructor(db) {
+    this.db = db;
+    db.run("PRAGMA journal_mode = WAL");
+    for (const stmt of SCHEMA)
+      db.run(stmt);
+  }
+  list() {
+    const rows = this.db.query("SELECT * FROM sim_suites ORDER BY updated DESC").all();
+    return rows.map((r) => ({
+      id: r.id,
+      name: r.name,
+      packets: JSON.parse(r.packets),
+      updated: r.updated
+    }));
+  }
+  get(id) {
+    const row = this.db.query("SELECT * FROM sim_suites WHERE id = $id").get({ $id: id });
+    return row ? {
+      id: row.id,
+      name: row.name,
+      packets: JSON.parse(row.packets),
+      updated: row.updated
+    } : null;
+  }
+  save(suite) {
+    this.db.query(`INSERT OR REPLACE INTO sim_suites (id, name, packets, updated)
+         VALUES ($id,$name,$packets,$updated)`).run({
+      $id: suite.id,
+      $name: suite.name,
+      $packets: JSON.stringify(suite.packets),
+      $updated: suite.updated
+    });
+  }
+}
+var storePromise3 = null;
+async function store2() {
+  storePromise3 ??= (async () => {
+    try {
+      mkdirSync7(dirname6(DEFAULT_SNAPSHOT_DB), { recursive: true });
+    } catch {}
+    const { Database } = await import("bun:sqlite");
+    return new SqliteSuiteStore(new Database(DEFAULT_SNAPSHOT_DB, { create: true }));
+  })();
+  return storePromise3;
+}
+async function listSuites() {
+  try {
+    return (await store2()).list();
+  } catch (e) {
+    logger.error(`sim suite read failed: ${e instanceof Error ? e.message : String(e)}`);
+    return [];
+  }
+}
+async function getSuite(id) {
+  try {
+    return (await store2()).get(id);
+  } catch {
+    return null;
+  }
+}
+async function saveSuite(input) {
+  const suite = {
+    id: input.id ?? `suite_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+    name: input.name,
+    packets: input.packets,
+    updated: Date.now()
+  };
+  try {
+    (await store2()).save(suite);
+  } catch (e) {
+    logger.error(`sim suite write failed: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  return suite;
+}
+
+// src/observability/sim-routes.ts
+var JSON_HEADERS6 = { "content-type": "application/json; charset=utf-8" };
+function json6(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS6 });
+}
+async function bodyJson3(req) {
+  return await req.json().catch(() => ({}));
+}
+var storePromise4 = null;
+function snapshots() {
+  storePromise4 ??= openSnapshotStore(DEFAULT_SNAPSHOT_DB);
+  return storePromise4;
+}
+async function configFor(body) {
+  if (body.configText)
+    return { text: body.configText, source: "supplied text" };
+  if (body.snapshotId) {
+    const snapshot = (await snapshots()).get(body.snapshotId);
+    if (!snapshot)
+      return { error: `no snapshot '${body.snapshotId}'` };
+    return { text: snapshot.body, source: `snapshot ${snapshot.id}` };
+  }
+  const device = body.device ?? getConfig().defaultDevice;
+  const ctx = createContext(undefined, device);
+  const text = await executeMikrotikCommand("/export terse", ctx);
+  if (looksLikeError(text) || text.trim() === "") {
+    return { error: `could not read the configuration of '${device}'` };
+  }
+  return { text, source: `live config of ${device}` };
+}
+async function simRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/sim"))
+    return null;
+  if (p === "/api/sim/suites" && req.method === "GET") {
+    return json6({ suites: await listSuites() });
+  }
+  if (p === "/api/sim/suites" && req.method === "POST") {
+    const body = await bodyJson3(req);
+    if (!body.name || !Array.isArray(body.packets) || body.packets.length === 0) {
+      return json6({ error: "name and a non-empty packets array are required" }, 400);
+    }
+    const saved = await saveSuite({
+      id: body.id,
+      name: body.name,
+      packets: body.packets
+    });
+    return json6({ suite: saved });
+  }
+  if (p === "/api/sim/packet" && req.method === "POST") {
+    const body = await bodyJson3(req);
+    const config = await configFor(body);
+    if ("error" in config)
+      return json6(config, 400);
+    const model = buildModel(config.text);
+    const result = tracePacket({ model, packet: body.packet });
+    return json6({
+      source: config.source,
+      result,
+      coverage: {
+        unmodelled: model.unmodelled,
+        unparsedLines: model.unparsedLines,
+        dynamicRouteSources: model.dynamicRouteSources
+      }
+    });
+  }
+  if (p === "/api/sim/change" && req.method === "POST") {
+    const body = await bodyJson3(req);
+    const config = await configFor(body);
+    if ("error" in config)
+      return json6(config, 400);
+    if (!body.changes || body.changes.trim() === "") {
+      return json6({ error: "changes are required" }, 400);
+    }
+    const before = tracePacket({ model: buildModel(config.text), packet: body.packet });
+    const afterModel = buildModel(`${config.text}
+${body.changes}
+`);
+    const after = tracePacket({ model: afterModel, packet: body.packet });
+    return json6({
+      source: config.source,
+      before,
+      after,
+      diff: diffTraces(before, after),
+      coverage: { unmodelled: afterModel.unmodelled, unparsedLines: afterModel.unparsedLines }
+    });
+  }
+  if (p === "/api/sim/reachability" && req.method === "GET") {
+    const config = await configFor({
+      device: url.searchParams.get("device") ?? undefined,
+      snapshotId: url.searchParams.get("snapshot") ?? undefined,
+      packet: {}
+    });
+    if ("error" in config)
+      return json6(config, 400);
+    const model = buildModel(config.text);
+    const dead = unreachableRules(model.filter);
+    return json6({
+      source: config.source,
+      rules: model.filter.map((r) => ({
+        chain: r.chain,
+        index: r.index,
+        action: r.action,
+        line: r.line,
+        raw: r.raw,
+        disabled: r.disabled,
+        unreachable: dead.some((d) => d.rule === r),
+        shadowedBy: dead.find((d) => d.rule === r)?.shadowedBy.index,
+        why: dead.find((d) => d.rule === r)?.why
+      })),
+      unreachableCount: dead.length
+    });
+  }
+  const runMatch = p.startsWith("/api/sim/suite/") && p.endsWith("/run");
+  if (runMatch && req.method === "POST") {
+    const id = decodeURIComponent(p.slice("/api/sim/suite/".length, -"/run".length));
+    const suite = await getSuite(id);
+    if (!suite)
+      return json6({ error: `no suite '${id}'` }, 404);
+    const body = await bodyJson3(req);
+    const config = await configFor({ ...body, packet: {} });
+    if ("error" in config)
+      return json6(config, 400);
+    const model = buildModel(config.text);
+    const results = suite.packets.map((entry) => {
+      const result = tracePacket({ model, packet: entry.packet });
+      return {
+        name: entry.name,
+        expect: entry.expect,
+        verdict: result.verdict,
+        ok: result.verdict === entry.expect,
+        summary: result.summary
+      };
+    });
+    return json6({
+      source: config.source,
+      suite: { id: suite.id, name: suite.name },
+      results,
+      passed: results.filter((r) => r.ok).length,
+      total: results.length
+    });
+  }
+  return json6({ error: "not found" }, 404);
+}
+
+// src/observability/schedule-routes.ts
+var JSON_HEADERS7 = { "content-type": "application/json; charset=utf-8" };
+function json7(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS7 });
+}
+function latestPerDevice(runs) {
+  const latest = new Map;
+  for (const run of runs) {
+    if (run.outcome !== "ok")
+      continue;
+    const key = run.device ?? "(fleet)";
+    const seen = latest.get(key);
+    if (!seen || run.startedAt > seen.startedAt)
+      latest.set(key, run);
+  }
+  return [...latest.values()];
+}
+function jobRow(job, runs, now) {
+  const current = latestPerDevice(runs);
+  const findings = current.flatMap((r) => r.findings);
+  return {
+    ...job,
+    cronText: describeCron(job.cron),
+    nextRun: nextRunOf(job.id) ?? nextRun(job.cron, now),
+    lastRun: runs[0] ? {
+      startedAt: runs[0].startedAt,
+      finishedAt: runs[0].finishedAt,
+      outcome: runs[0].outcome,
+      device: runs[0].device,
+      error: runs[0].error
+    } : null,
+    posture: {
+      total: findings.length,
+      worst: worstSeverity(findings) ?? null,
+      bySeverity: severityCounts(findings),
+      devices: current.length
+    },
+    runCount: runs.length
+  };
+}
+function regressionsFor(runs, jobId) {
+  const byDevice = new Map;
+  for (const run of runs) {
+    if (run.outcome !== "ok")
+      continue;
+    const key = run.device ?? "(fleet)";
+    const list = byDevice.get(key);
+    if (list)
+      list.push(run);
+    else
+      byDevice.set(key, [run]);
+  }
+  const out = [];
+  for (const [device, list] of byDevice) {
+    for (let i = 0;i < list.length - 1; i++) {
+      const diff = diffFindings(list[i + 1].findings, list[i].findings);
+      if (diff.added.length + diff.worsened.length + diff.resolved.length === 0)
+        continue;
+      out.push({
+        jobId,
+        device,
+        at: list[i].startedAt,
+        summary: describeDiff(diff),
+        added: diff.added,
+        worsened: diff.worsened,
+        resolved: diff.resolved
+      });
+    }
+  }
+  return out.sort((a, b) => b.at - a.at);
+}
+async function scheduleRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/schedules"))
+    return null;
+  let store3;
+  try {
+    store3 = await scheduleStore();
+  } catch (e) {
+    return json7({ error: e instanceof Error ? e.message : String(e), jobs: [] }, 503);
+  }
+  const now = Date.now();
+  if (p === "/api/schedules" && req.method === "GET") {
+    const jobs = store3.listJobs().map((job) => jobRow(job, store3.runs(job.id, 500), now));
+    return json7({
+      jobs,
+      schedulable: schedulableTools().map((a) => ({ tool: a.tool, summary: a.summary }))
+    });
+  }
+  if (p === "/api/schedules" && req.method === "POST") {
+    const body = await req.json().catch(() => null);
+    if (!body)
+      return json7({ error: "invalid JSON body" }, 400);
+    const parsed = JobSchema.safeParse(body);
+    if (!parsed.success) {
+      return json7({
+        error: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")
+      }, 400);
+    }
+    if (!auditAdapter(parsed.data.tool)) {
+      return json7({ error: `'${parsed.data.tool}' is not a schedulable auditor` }, 400);
+    }
+    await primeRiskIndex();
+    const risk = liveExecutor().riskOf(parsed.data.tool);
+    if (risk !== "READ") {
+      return json7({ error: `'${parsed.data.tool}' is annotated ${risk}; only READ may be scheduled` }, 400);
+    }
+    const existing = store3.getJob(parsed.data.id);
+    const job = { ...parsed.data, createdAt: existing?.createdAt ?? now };
+    store3.saveJob(job);
+    if (job.enabled)
+      armJob(job, now);
+    else
+      forgetJob(job.id);
+    return json7({ job: jobRow(job, store3.runs(job.id, 500), now), replaced: existing !== null });
+  }
+  if (p === "/api/schedules/timeline" && req.method === "GET") {
+    const jobId = url.searchParams.get("job") ?? undefined;
+    const device = url.searchParams.get("device") ?? undefined;
+    const days = Number(url.searchParams.get("days") ?? 30);
+    const since = now - days * 86400000;
+    const runs = store3.runs(jobId, 2000).filter((r) => r.startedAt >= since && (!device || r.device === device));
+    return json7({
+      points: runs.map((r) => ({
+        at: r.startedAt,
+        jobId: r.jobId,
+        device: r.device,
+        outcome: r.outcome,
+        total: r.findings.length,
+        bySeverity: severityCounts(r.findings),
+        added: r.added,
+        worsened: r.worsened,
+        resolved: r.resolved,
+        durationMs: r.finishedAt - r.startedAt
+      })).sort((a, b) => a.at - b.at)
+    });
+  }
+  if (p === "/api/schedules/regressions" && req.method === "GET") {
+    const jobId = url.searchParams.get("job") ?? undefined;
+    const limit = Number(url.searchParams.get("limit") ?? 50);
+    const jobs = jobId ? [jobId] : store3.listJobs().map((j) => j.id);
+    const items = jobs.flatMap((id2) => regressionsFor(store3.runs(id2, 500), id2)).sort((a, b) => b.at - a.at).slice(0, limit);
+    return json7({ regressions: items });
+  }
+  const parts = p.slice("/api/schedules/".length).split("/").filter(Boolean);
+  if (parts.length === 0 || parts.length > 2)
+    return json7({ error: "not found" }, 404);
+  const id = decodeURIComponent(parts[0]);
+  const verb = parts[1];
+  if (!verb && req.method === "DELETE") {
+    const job = store3.getJob(id);
+    if (!job)
+      return json7({ error: `no schedule '${id}'` }, 404);
+    const runCount = store3.runs(id, 1e4).length;
+    store3.removeJob(id);
+    forgetJob(id);
+    return json7({ removed: id, runsDiscarded: runCount });
+  }
+  if (verb === "run" && req.method === "POST") {
+    const job = store3.getJob(id);
+    if (!job)
+      return json7({ error: `no schedule '${id}'` }, 404);
+    await primeRiskIndex();
+    logger.info(`schedule '${id}' run requested from the dashboard`);
+    const result = await runJob(job, liveExecutor(), runnerOptions());
+    return json7({
+      ...result,
+      job: jobRow(job, store3.runs(id, 500), Date.now())
+    });
+  }
+  if (!verb && req.method === "GET") {
+    const job = store3.getJob(id);
+    if (!job)
+      return json7({ error: `no schedule '${id}'` }, 404);
+    const runs = store3.runs(id, 500);
+    return json7({ job: jobRow(job, runs, now), runs, regressions: regressionsFor(runs, id) });
+  }
+  return json7({ error: "not found" }, 404);
+}
+
+// src/observability/explain-routes.ts
+var JSON_HEADERS8 = { "content-type": "application/json; charset=utf-8" };
+function json8(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS8 });
+}
+var storePromise5 = null;
+function snapshots2() {
+  storePromise5 ??= openSnapshotStore(DEFAULT_SNAPSHOT_DB);
+  return storePromise5;
+}
+async function configFor2(device, snapshotId) {
+  if (snapshotId) {
+    const snapshot = (await snapshots2()).get(snapshotId);
+    if (!snapshot)
+      return { error: `no snapshot '${snapshotId}'`, status: 404 };
+    return {
+      text: snapshot.body,
+      device: snapshot.device ?? device,
+      source: `snapshot ${snapshotId}`
+    };
+  }
+  const name = resolveDeviceName(device);
+  const body = await executeMikrotikCommand("/export", createContext(undefined, name));
+  if (looksLikeError(body) || body.trim() === "") {
+    return { error: body.trim() || "the device returned an empty export", status: 502 };
+  }
+  return { text: body, device: name, source: "live device" };
+}
+function payload(narrative, source, markdown) {
+  return {
+    narrative,
+    markdown,
+    mermaid: topologyMermaid(narrative),
+    source
+  };
+}
+async function explainRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/explain"))
+    return null;
+  if (p === "/api/explain/diff" && req.method === "POST") {
+    const body = await req.json().catch(() => null);
+    if (!body)
+      return json8({ error: "invalid JSON body" }, 400);
+    if (!body.before && !body.beforeText) {
+      return json8({ error: "a diff needs a baseline: pass `before` (a snapshot id) or `beforeText`" }, 400);
+    }
+    const device2 = body.device ?? "";
+    const before = body.beforeText ? { text: body.beforeText, device: device2, source: "supplied text" } : await configFor2(device2, body.before ?? null);
+    if ("error" in before)
+      return json8({ error: `before: ${before.error}` }, before.status);
+    const after = body.afterText ? { text: body.afterText, device: device2, source: "supplied text" } : await configFor2(device2, body.after ?? null);
+    if ("error" in after)
+      return json8({ error: `after: ${after.error}` }, after.status);
+    const diff = diffNarratives(analyzeDevice(before.text, before.device), analyzeDevice(after.text, after.device));
+    return json8({ diff, markdown: renderDiff(diff), before: before.source, after: after.source });
+  }
+  const rest = p.slice("/api/explain/".length).split("/").filter(Boolean);
+  if (rest.length === 0)
+    return json8({ error: "not found" }, 404);
+  if (req.method !== "GET")
+    return json8({ error: "not found" }, 404);
+  const device = decodeURIComponent(rest[0]);
+  const snapshotId = url.searchParams.get("snapshot");
+  let config;
+  try {
+    config = await configFor2(device, snapshotId);
+  } catch (e) {
+    return json8({ error: e instanceof Error ? e.message : String(e) }, 502);
+  }
+  if ("error" in config)
+    return json8({ error: config.error }, config.status);
+  const narrative = { ...analyzeDevice(config.text, config.device), generatedAt: Date.now() };
+  if (rest.length === 1) {
+    return json8(payload(narrative, config.source, renderNarrative(narrative)));
+  }
+  if (rest[1] === "section" && rest[2]) {
+    const section = decodeURIComponent(rest[2]);
+    if (!NARRATIVE_SECTIONS.includes(section)) {
+      return json8({ error: `unknown section '${section}'. Known: ${NARRATIVE_SECTIONS.join(", ")}` }, 400);
+    }
+    return json8(payload(narrative, config.source, renderNarrative(narrative, { sections: [section] })));
+  }
+  return json8({ error: "not found" }, 404);
+}
+
+// src/observability/attack-routes.ts
+var JSON_HEADERS9 = { "content-type": "application/json; charset=utf-8" };
+function json9(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS9 });
+}
+async function attackRoutes(req, url) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/attacks"))
+    return null;
+  let store3;
+  try {
+    store3 = await attackStore();
+  } catch (e) {
+    return json9({ error: e instanceof Error ? e.message : String(e), incidents: [] }, 503);
+  }
+  const cfg = getConfig().attacks;
+  const now = Date.now();
+  if (p === "/api/attacks" && req.method === "GET") {
+    const hours = Number(url.searchParams.get("hours") ?? 24);
+    const incidents = store3.listIncidents({
+      since: now - hours * 3600000,
+      limit: Number(url.searchParams.get("limit") ?? 200)
+    });
+    const responses = store3.listResponses({ active: true, limit: 500 });
+    const blocked = new Set(responses.map((r) => r.source));
+    return json9({
+      incidents: incidents.map((i) => ({ ...i, blocked: blocked.has(i.source) })),
+      responses,
+      posture: {
+        enabled: cfg.enabled,
+        mode: cfg.mode,
+        autoRespondTo: cfg.autoRespondTo,
+        minConfidence: cfg.minConfidence
+      }
+    });
+  }
+  if (p === "/api/attacks/sources" && req.method === "GET") {
+    const hours = Number(url.searchParams.get("hours") ?? 168);
+    const incidents = store3.listIncidents({ since: now - hours * 3600000, limit: 1000 });
+    const bySource = new Map;
+    for (const i of incidents) {
+      if (i.source === "")
+        continue;
+      const seen = bySource.get(i.source);
+      if (seen) {
+        for (const d of i.devices)
+          seen.devices.add(d);
+        for (const d of i.detectors)
+          seen.detectors.add(d);
+        seen.firstTs = Math.min(seen.firstTs, i.firstTs);
+        seen.lastTs = Math.max(seen.lastTs, i.lastTs);
+        seen.incidents++;
+      } else {
+        bySource.set(i.source, {
+          source: i.source,
+          devices: new Set(i.devices),
+          detectors: new Set(i.detectors),
+          firstTs: i.firstTs,
+          lastTs: i.lastTs,
+          incidents: 1,
+          worst: i.severity
+        });
+      }
+    }
+    const active = new Set(store3.listResponses({ active: true, limit: 500 }).map((r) => r.source));
+    return json9({
+      sources: [...bySource.values()].map((s) => ({
+        source: s.source,
+        devices: [...s.devices].sort(),
+        detectors: [...s.detectors].sort(),
+        firstTs: s.firstTs,
+        lastTs: s.lastTs,
+        incidents: s.incidents,
+        worst: s.worst,
+        blocked: active.has(s.source),
+        geo: getDeviceGeo(s.source)
+      })).sort((a, b) => b.incidents - a.incidents || b.lastTs - a.lastTs)
+    });
+  }
+  if (p === "/api/attacks/config" && req.method === "GET") {
+    const guards = buildGuards();
+    const never = [...neverBlockSet(guards)].sort();
+    const check = url.searchParams.get("check");
+    return json9({
+      config: cfg,
+      neverBlock: never,
+      check: check ? { address: check, protected: isNeverBlock(check, new Set(never)) } : undefined
+    });
+  }
+  if (p === "/api/attacks/config" && req.method === "POST") {
+    return json9({
+      error: "edit the `attacks` block in Config \u2014 the policy has to survive a restart, so it is not held in memory here"
+    }, 501);
+  }
+  if (p === "/api/attacks/scan" && req.method === "POST") {
+    logger.info("attack sweep requested from the dashboard");
+    const result = await sweep({ respond: false });
+    return json9({
+      incidents: result.incidents,
+      unavailable: result.unavailable,
+      devices: result.devices
+    });
+  }
+  const rest = p.slice("/api/attacks/".length).split("/").filter(Boolean);
+  if (rest[0] === "responses" && rest[1] && req.method === "DELETE") {
+    const address = decodeURIComponent(rest[1]);
+    const response = store3.responseFor(address);
+    const devices = response?.devices ?? [];
+    if (devices.length === 0)
+      return json9({ error: `no recorded block for ${address}` }, 404);
+    const results = await revokeBlock(address, devices, response?.list);
+    store3.revokeResponse(address, now);
+    return json9({ address, results });
+  }
+  if (rest.length === 1 && req.method === "GET") {
+    const incident = store3.getIncident(decodeURIComponent(rest[0]));
+    if (!incident)
+      return json9({ error: "not found" }, 404);
+    return json9({ incident, response: store3.responseFor(incident.source) });
+  }
+  if (rest.length === 2 && rest[1] === "respond" && req.method === "POST") {
+    const incident = store3.getIncident(decodeURIComponent(rest[0]));
+    if (!incident)
+      return json9({ error: "not found" }, 404);
+    const body = await req.json().catch(() => ({}));
+    if (body.action === "dismiss") {
+      return json9({ dismissed: incident.id });
+    }
+    const decision = decide({
+      incident,
+      policy: policyFromConfig(),
+      guards: buildGuards(),
+      recentBlockCount: store3.countRecentBlocks(incident.devices, now - 3600000),
+      manual: true,
+      confirm: body.confirm ?? false,
+      timeout: body.timeout
+    });
+    if (!isPlan(decision)) {
+      return json9({ refused: true, guard: decision.guard, reason: decision.reason }, 200);
+    }
+    if (decision.action === "escalate") {
+      return json9({ escalated: true, reason: decision.reason });
+    }
+    if (!body.confirm) {
+      return json9({ dryRun: true, plan: decision });
+    }
+    const applied = await executePlan(decision);
+    const ok = applied.some((r) => r.ok);
+    store3.recordResponse({
+      incidentId: incident.id,
+      action: decision.action,
+      source: decision.source,
+      devices: decision.devices,
+      timeout: decision.timeout,
+      list: decision.list,
+      reason: decision.reason,
+      ts: now,
+      ok,
+      error: ok ? undefined : applied.map((r) => r.detail).join("; ")
+    });
+    return json9({ applied, ok, plan: decision });
+  }
+  return json9({ error: "not found" }, 404);
+}
+
+// src/observability/alert-routes.ts
+var JSON_HEADERS10 = { "content-type": "application/json; charset=utf-8" };
+function json10(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS10 });
+}
+function ruleRow(rule, subject, status, since) {
+  return {
+    id: rule.id,
+    subject,
+    description: rule.description,
+    when: rule.when,
+    severity: rule.severity,
+    channels: rule.channels,
+    for: rule.for,
+    cooldown: rule.cooldown,
+    enabled: rule.enabled,
+    mutedUntil: rule.mutedUntil,
+    status,
+    since,
+    warnings: ruleWarnings(rule)
+  };
+}
+function previewRule(rule, events) {
+  if (!isEventTrigger(rule.when))
+    return { fires: 0, resolves: 0, matched: 0 };
+  let state = initialState(events[0]?.ts ?? 0);
+  let fires = 0;
+  let resolves = 0;
+  let matched = 0;
+  for (const e of [...events].sort((a, b) => a.ts - b.ts)) {
+    const ev = {
+      kind: "tool_call",
+      tool: e.tool,
+      device: e.device,
+      risk: e.risk,
+      isError: e.isError
+    };
+    const met = eventMet(rule.when, ev);
+    if (met)
+      matched++;
+    const res = step(rule, state, met, e.ts);
+    state = res.state;
+    if (res.action.type === "fire")
+      fires++;
+    if (res.action.type === "resolve")
+      resolves++;
+  }
+  return { fires, resolves, matched };
+}
+async function alertRoutes(req, url, db) {
+  const p = url.pathname;
+  if (!p.startsWith("/api/alerts"))
+    return null;
+  const engine = getAlertEngine();
+  const channels = getConfig().alerts?.channels;
+  if (p === "/api/alerts" && req.method === "GET") {
+    if (!engine) {
+      return json10({ configured: false, rules: [], active: [], channels: {} });
+    }
+    const now = Date.now();
+    const rows = engine.snapshot().map(({ rule, subject, state }) => ruleRow(rule, subject, isMuted(rule, now) ? "muted" : !rule.enabled ? "disabled" : state.status, state.since));
+    return json10({
+      configured: true,
+      rules: rows,
+      active: rows.filter((r) => r.status === "firing"),
+      channels: redactChannels(channels)
+    });
+  }
+  if (p === "/api/alerts/history" && req.method === "GET") {
+    if (!engine)
+      return json10({ history: [] });
+    const hours = Number(url.searchParams.get("hours") ?? 24);
+    const history = await engine.history({
+      sinceMs: Date.now() - hours * 3600000,
+      ruleId: url.searchParams.get("rule") ?? undefined,
+      limit: Number(url.searchParams.get("limit") ?? 200)
+    });
+    return json10({ history });
+  }
+  if (p === "/api/alerts/rules" && req.method === "POST") {
+    if (!engine)
+      return json10({ error: "alerting is not configured" }, 400);
+    const parsed = AlertRuleSchema.safeParse(await req.json());
+    if (!parsed.success) {
+      return json10({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+    }
+    const rules = engine.configuredRules();
+    if (rules.some((r) => r.id === parsed.data.id)) {
+      return json10({ error: `rule '${parsed.data.id}' already exists` }, 409);
+    }
+    engine.setRules([...rules, parsed.data]);
+    return json10({ ok: true, id: parsed.data.id });
+  }
+  const idMatch = p.match(/^\/api\/alerts\/rules\/([^/]+)$/);
+  if (idMatch) {
+    if (!engine)
+      return json10({ error: "alerting is not configured" }, 400);
+    const id = decodeURIComponent(idMatch[1]);
+    const rules = engine.configuredRules();
+    const existing = rules.find((r) => r.id === id);
+    if (!existing)
+      return json10({ error: `unknown rule: ${id}` }, 404);
+    if (req.method === "DELETE") {
+      engine.setRules(rules.filter((r) => r.id !== id));
+      return json10({ ok: true });
+    }
+    if (req.method === "PATCH") {
+      const body = await req.json();
+      let mutedUntil = existing.mutedUntil;
+      if (typeof body.mute === "string") {
+        const ms = parseDuration(body.mute);
+        if (ms === null)
+          return json10({ error: `invalid duration: ${body.mute}` }, 400);
+        mutedUntil = ms === 0 ? undefined : Date.now() + ms;
+        delete body.mute;
+      }
+      const merged = AlertRuleSchema.safeParse({ ...existing, ...body, mutedUntil });
+      if (!merged.success) {
+        return json10({ error: merged.error.issues.map((i) => i.message).join("; ") }, 400);
+      }
+      engine.setRules(rules.map((r) => r.id === id ? merged.data : r));
+      return json10({ ok: true, rule: merged.data });
+    }
+  }
+  if (p === "/api/alerts/test" && req.method === "POST") {
+    const body = await req.json();
+    if (!channels || !body?.channel)
+      return json10({ error: "channel is required" }, 400);
+    try {
+      const result = await deliver(body.channel, channels, {
+        ruleId: "test",
+        severity: "low",
+        kind: "fire",
+        title: "Test notification from mikrotik-mcp",
+        body: "If you can read this, this channel is configured correctly.",
+        at: Date.now()
+      });
+      return json10(result);
+    } catch (e) {
+      logger.error(`Alert channel test failed: ${logError(e)}`);
+      return json10({ error: clientError(e) }, 502);
+    }
+  }
+  if (p === "/api/alerts/preview" && req.method === "POST") {
+    const parsed = AlertRuleSchema.safeParse(await req.json());
+    if (!parsed.success) {
+      return json10({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+    }
+    const hours = Number(url.searchParams.get("hours") ?? 24);
+    if (!db) {
+      return json10({ hours, sampled: 0, fires: 0, resolves: 0, matched: 0, noHistory: true });
+    }
+    const events = db.query({ since: Date.now() - hours * 3600000, limit: 5000 }).map((e) => ({
+      ts: e.ts,
+      tool: e.tool,
+      device: e.device,
+      risk: e.risk,
+      isError: e.isError
+    }));
+    return json10({ hours, sampled: events.length, ...previewRule(parsed.data, events) });
+  }
+  return null;
+}
+
+// src/observability/memory-routes.ts
+var JSON_HEADERS11 = { "content-type": "application/json; charset=utf-8" };
+function json11(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS11 });
+}
+async function bodyJson4(req) {
   return await req.json();
 }
 async function memoryRoutes(req, url) {
@@ -1851,29 +2951,29 @@ async function memoryRoutes(req, url) {
     return null;
   const cfg = getConfig();
   if (!cfg.memory.enabled) {
-    return json2({ error: "Knowledge-graph memory is disabled" }, 503);
+    return json11({ error: "Knowledge-graph memory is disabled" }, 503);
   }
   if (p === "/api/memory/config" && req.method === "GET") {
     let stats = null;
     try {
-      const store2 = await getMemoryStore();
-      stats = store2.stats();
+      const store4 = await getMemoryStore();
+      stats = store4.stats();
     } catch {}
-    return json2({
+    return json11({
       enabled: cfg.memory.enabled,
       dbPath: cfg.memory.dbPath,
       stats
     });
   }
   if (p === "/api/memory/config" && req.method === "POST") {
-    const body = await bodyJson2(req);
+    const body = await bodyJson4(req);
     const updates = {};
     if (body.dbPath !== undefined && typeof body.dbPath === "string" && body.dbPath !== cfg.memory.dbPath) {
       updates.dbPath = body.dbPath;
       try {
         await reopenMemoryStore(body.dbPath);
       } catch (e) {
-        return json2({
+        return json11({
           error: `Failed to open memory DB at ${body.dbPath}: ${e instanceof Error ? e.message : String(e)}`
         }, 400);
       }
@@ -1892,79 +2992,79 @@ async function memoryRoutes(req, url) {
     }
     let stats = null;
     try {
-      const store2 = await getMemoryStore();
-      stats = store2.stats();
+      const store4 = await getMemoryStore();
+      stats = store4.stats();
     } catch {}
-    return json2({
+    return json11({
       ok: true,
       enabled: getConfig().memory.enabled,
       dbPath: getConfig().memory.dbPath,
       stats
     });
   }
-  const store = await getMemoryStore();
+  const store3 = await getMemoryStore();
   if (p === "/api/memory/graph" && req.method === "GET") {
-    return json2(store.readGraph());
+    return json11(store3.readGraph());
   }
   if (p === "/api/memory/stats" && req.method === "GET") {
-    return json2(store.stats());
+    return json11(store3.stats());
   }
   if (p === "/api/memory/search" && req.method === "GET") {
     const q = url.searchParams.get("q") || "";
     const limit = Number(url.searchParams.get("limit") ?? 50);
-    return json2(store.searchNodes(q, limit));
+    return json11(store3.searchNodes(q, limit));
   }
   if (p === "/api/memory/activity" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 50);
     const since = url.searchParams.get("since");
-    return json2(store.activity(limit, since ? Number(since) : undefined));
+    return json11(store3.activity(limit, since ? Number(since) : undefined));
   }
   const entityMatch = p.match(/^\/api\/memory\/entity\/(.+)$/);
   if (entityMatch && req.method === "GET") {
     const name = decodeURIComponent(entityMatch[1]);
-    const graph = store.openNodes([name]);
+    const graph = store3.openNodes([name]);
     if (graph.entities.length === 0)
-      return json2({ error: "Entity not found" }, 404);
-    return json2({ entity: graph.entities[0], relations: graph.relations });
+      return json11({ error: "Entity not found" }, 404);
+    return json11({ entity: graph.entities[0], relations: graph.relations });
   }
   if (p === "/api/memory/entities" && req.method === "POST") {
-    const body = await bodyJson2(req);
-    const created = store.createEntities(body.entities ?? []);
-    return json2({ created, count: created.length });
+    const body = await bodyJson4(req);
+    const created = store3.createEntities(body.entities ?? []);
+    return json11({ created, count: created.length });
   }
   if (p === "/api/memory/relations" && req.method === "POST") {
-    const body = await bodyJson2(req);
-    const created = store.createRelations(body.relations ?? []);
-    return json2({ created, count: created.length });
+    const body = await bodyJson4(req);
+    const created = store3.createRelations(body.relations ?? []);
+    return json11({ created, count: created.length });
   }
   if (p === "/api/memory/observations" && req.method === "POST") {
-    const body = await bodyJson2(req);
-    const results = store.addObservations(body.observations ?? []);
-    return json2({ results });
+    const body = await bodyJson4(req);
+    const results = store3.addObservations(body.observations ?? []);
+    return json11({ results });
   }
   if (p === "/api/memory/entities" && req.method === "DELETE") {
-    const body = await bodyJson2(req);
-    const removed = store.deleteEntities(body.names ?? []);
-    return json2({ removed });
+    const body = await bodyJson4(req);
+    const removed = store3.deleteEntities(body.names ?? []);
+    return json11({ removed });
   }
   if (p === "/api/memory/relations" && req.method === "DELETE") {
-    const body = await bodyJson2(req);
-    const removed = store.deleteRelations(body.relations ?? []);
-    return json2({ removed });
+    const body = await bodyJson4(req);
+    const removed = store3.deleteRelations(body.relations ?? []);
+    return json11({ removed });
   }
   if (p === "/api/memory/observations" && req.method === "DELETE") {
-    const body = await bodyJson2(req);
-    const removed = store.deleteObservations(body.deletions ?? []);
-    return json2({ removed });
+    const body = await bodyJson4(req);
+    const removed = store3.deleteObservations(body.deletions ?? []);
+    return json11({ removed });
   }
   return null;
 }
 
 // src/observability/dashboard.ts
 var SERVER_TAG3 = "mikrotik-mcp";
-var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
+var JSON_HEADERS12 = { "content-type": "application/json; charset=utf-8" };
+function json12(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS12 });
 }
 function restartProcess() {
   let ok = false;
@@ -1992,7 +3092,7 @@ function runUpgrade(spec) {
       env: process.env,
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const timer5 = setTimeout(() => {
+    const timer4 = setTimeout(() => {
       child.kill();
       resolve({ ok: false, log: `${out}
 (timed out after 180s)` });
@@ -2000,12 +3100,12 @@ function runUpgrade(spec) {
     child.stdout?.on("data", (d) => out += d.toString());
     child.stderr?.on("data", (d) => out += d.toString());
     child.on("error", (e) => {
-      clearTimeout(timer5);
+      clearTimeout(timer4);
       resolve({ ok: false, log: `${out}
 spawn error: ${String(e)}` });
     });
     child.on("exit", (code) => {
-      clearTimeout(timer5);
+      clearTimeout(timer4);
       resolve({ ok: code === 0, log: out.trim() || `(exit ${code})` });
     });
   });
@@ -2039,8 +3139,8 @@ function filterFromQuery(url) {
     until: num("until")
   };
 }
-function facets(store) {
-  const recent = store.query({ limit: 5000 });
+function facets(store3) {
+  const recent = store3.query({ limit: 5000 });
   const tools = new Set;
   const devices = new Set;
   for (const e of recent) {
@@ -2053,8 +3153,8 @@ function facets(store) {
     devices: [...devices].sort()
   };
 }
-function deviceActivity(store) {
-  const recent = store.query({ limit: 5000 });
+function deviceActivity(store3) {
+  const recent = store3.query({ limit: 5000 });
   const map = new Map;
   for (const e of recent) {
     if (!e.device)
@@ -2083,9 +3183,9 @@ function deviceActivity(store) {
   }
   return out;
 }
-function devicesPayload(store) {
+function devicesPayload(store3) {
   const cfg = getConfig();
-  const activity = deviceActivity(store);
+  const activity = deviceActivity(store3);
   const poolEnabled = isPoolEnabled();
   const poolMap = new Map(poolStatus().map((p) => [p.device, p]));
   const devices = Object.entries(cfg.devices).map(([name, dc]) => {
@@ -2096,7 +3196,8 @@ function devicesPayload(store) {
       host: dc.host,
       port: dc.port,
       mac: dc.mac,
-      transport: dc.mac ? "mac-telnet" : "ssh",
+      transport: dc.mac ? "mac-telnet" : dc.api ? "rest" : "ssh",
+      restPort: dc.api ? dc.apiPort ?? 443 : undefined,
       address: dc.mac ? dc.mac : `${dc.host}:${dc.port}`,
       username: dc.username,
       authMode: dc.mac ? "mac-telnet" : dc.keyFilename || dc.privateKey ? "key" : dc.password ? "password" : "none",
@@ -2258,11 +3359,11 @@ function issues(error) {
 async function configRoutes(req, url, admin) {
   const p = url.pathname;
   if (p === "/api/config-schema" && req.method === "GET") {
-    return json3(configSchemaJson());
+    return json12(configSchemaJson());
   }
   if (p === "/api/config/validate" && req.method === "POST") {
     const merged = mergeSecrets(await readJson(req), getConfig());
-    return json3(validateConfig(merged));
+    return json12(validateConfig(merged));
   }
   if (p === "/api/config/test-device" && req.method === "POST") {
     const body = await readJson(req);
@@ -2271,22 +3372,22 @@ async function configRoutes(req, url, admin) {
     const merged = mergeSecrets(body?.config, currentDc);
     const parsed = DeviceConfigSchema.safeParse(merged);
     if (!parsed.success)
-      return json3({ ok: false, errors: issues(parsed.error) }, 400);
+      return json12({ ok: false, errors: issues(parsed.error) }, 400);
     const status = await probeDevice(`config-test:${name}`, parsed.data);
-    return json3({ ok: true, status });
+    return json12({ ok: true, status });
   }
   if (p === "/api/config/preview" && req.method === "POST") {
     const before = JSON.stringify(redact(getConfig()), null, 2);
     const after = JSON.stringify(await readJson(req) ?? {}, null, 2);
     const d = diffLines(before, after, { fromLabel: "current", toLabel: "edited" });
-    return json3({ summary: d.summary, unified: d.unified });
+    return json12({ summary: d.summary, unified: d.unified });
   }
   if (p === "/api/config" && req.method === "POST") {
     const body = await readJson(req);
     const merged = mergeSecrets(body?.config, getConfig());
     const v = validateConfig(merged);
     if (!v.ok || !v.value)
-      return json3({ ok: false, errors: v.errors }, 400);
+      return json12({ ok: false, errors: v.errors }, 400);
     const prev = getConfig();
     const before = JSON.stringify(redact(prev), null, 2);
     const after = JSON.stringify(redact(v.value), null, 2);
@@ -2295,25 +3396,25 @@ async function configRoutes(req, url, admin) {
     const nextDevs = Object.keys(v.value.devices);
     const devicesChanged = prevDevs.length !== nextDevs.length || prevDevs.some((d) => !nextDevs.includes(d));
     const res = admin.applyConfig(v.value, clampRollback(body?.rollbackMs));
-    return json3({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
+    return json12({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
   }
   if (p === "/api/config/keep" && req.method === "POST") {
     const body = await readJson(req);
     const kept = admin.keepConfig(String(body?.pendingId ?? ""));
     if (kept)
       recordVersion(getConfig(), "auto", Date.now());
-    return json3({ kept });
+    return json12({ kept });
   }
   if (p === "/api/config/rollback" && req.method === "POST") {
     const body = await readJson(req);
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
-    return json3({ rolledBack, config: redact(getConfig()) });
+    return json12({ rolledBack, config: redact(getConfig()) });
   }
   if (p === "/api/reload" && req.method === "POST") {
     const body = await readJson(req);
     if (body?.hard === true) {
       const relaunched = restartProcess();
-      return json3({
+      return json12({
         ok: true,
         mode: "restart",
         note: relaunched ? "Restarting now \u2014 a fresh server process was launched and will bind the same port(s) in ~1.5s. Reconnect shortly." : "Could not self-relaunch; the process is exiting. It only comes back if a supervisor respawns it."
@@ -2324,10 +3425,10 @@ async function configRoutes(req, url, admin) {
       setConfig(cfg);
       const devices = Object.keys(cfg.devices);
       logger.info(`Config reloaded from source \u2014 ${devices.length} device(s): ${devices.join(", ")}`);
-      return json3({ ok: true, mode: "config", count: devices.length, devices });
+      return json12({ ok: true, mode: "config", count: devices.length, devices });
     } catch (e) {
       logger.error(`Config reload failed: ${logError(e)}`);
-      return json3({ ok: false, error: clientError(e) }, 500);
+      return json12({ ok: false, error: clientError(e) }, 500);
     }
   }
   if (p === "/api/config/history" && req.method === "GET") {
@@ -2343,55 +3444,55 @@ async function configRoutes(req, url, admin) {
       } catch {}
       return { ...v, drift: { added, removed } };
     });
-    return json3({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
+    return json12({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
   }
   if (p === "/api/config/history/get" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json3({ error: "id required" }, 400);
+      return json12({ error: "id required" }, 400);
     try {
       const v = readVersion(id);
-      return json3({
+      return json12({
         ts: v.ts,
         kind: v.kind,
         label: v.label,
         config: JSON.stringify(redact(v.config), null, 2)
       });
     } catch {
-      return json3({ error: "not found" }, 404);
+      return json12({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/diff" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json3({ error: "id required" }, 400);
+      return json12({ error: "id required" }, 400);
     try {
       const before = JSON.stringify(redact(readVersion(id).config), null, 2);
       const after = JSON.stringify(redact(getConfig()), null, 2);
       const d = diffLines(before, after, { fromLabel: "this version", toLabel: "current" });
-      return json3({ summary: d.summary, unified: d.unified });
+      return json12({ summary: d.summary, unified: d.unified });
     } catch {
-      return json3({ error: "not found" }, 404);
+      return json12({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/checkpoint" && req.method === "POST") {
     const b = await readJson(req);
     const label = b?.label?.trim() || "checkpoint";
-    return json3({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
+    return json12({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
   }
   if (p === "/api/config/history/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json3({ error: "id required" }, 400);
+      return json12({ error: "id required" }, 400);
     let target;
     try {
       target = readVersion(b.id);
     } catch {
-      return json3({ error: "not found" }, 404);
+      return json12({ error: "not found" }, 404);
     }
     const v = validateConfig(target.config);
     if (!v.ok || !v.value)
-      return json3({ ok: false, errors: v.errors }, 400);
+      return json12({ ok: false, errors: v.errors }, 400);
     recordVersion(getConfig(), "auto", Date.now(), "before restore");
     setConfig(v.value);
     let persisted = true;
@@ -2402,13 +3503,13 @@ async function configRoutes(req, url, admin) {
     }
     const label = target.label ? `restored "${target.label}"` : `restored ${b.id}`;
     recordVersion(getConfig(), "auto", Date.now(), label);
-    return json3({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
+    return json12({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
   }
   if (p === "/api/config/history/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json3({ error: "id required" }, 400);
-    return deleteVersion(b.id) ? json3({ ok: true }) : json3({ error: "not found" }, 404);
+      return json12({ error: "id required" }, 400);
+    return deleteVersion(b.id) ? json12({ ok: true }) : json12({ error: "not found" }, 404);
   }
   return null;
 }
@@ -2419,7 +3520,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules" && req.method === "GET") {
     const cfg = getConfig();
     const src = getConfigSource();
-    return json3({
+    return json12({
       ...moduleSurface(cfg.tools),
       filter: cfg.tools,
       source: src,
@@ -2429,11 +3530,11 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/toggle" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.slug !== "string" || typeof b?.enabled !== "boolean") {
-      return json3({ error: "slug (string) and enabled (boolean) are required" }, 400);
+      return json12({ error: "slug (string) and enabled (boolean) are required" }, 400);
     }
     const mod = moduleCatalog.find((m) => m.slug.toLowerCase() === b.slug.toLowerCase());
     if (!mod)
-      return json3({ error: `unknown module: ${b.slug}` }, 404);
+      return json12({ error: `unknown module: ${b.slug}` }, 404);
     const cfg = getConfig();
     const nextTools = ToolFilterSchema.parse(applyModuleToggle(cfg.tools, mod.slug, b.enabled));
     const next = { ...cfg, tools: nextTools };
@@ -2449,7 +3550,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `module ${b.enabled ? "enabled" : "disabled"}: ${mod.slug}`);
     }
-    return json3({
+    return json12({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -2464,7 +3565,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/app-views" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.enabled !== "boolean") {
-      return json3({ error: "enabled (boolean) is required" }, 400);
+      return json12({ error: "enabled (boolean) is required" }, 400);
     }
     const cfg = getConfig();
     const next = { ...cfg, mcp: { ...cfg.mcp, appViews: b.enabled } };
@@ -2480,7 +3581,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `app views ${b.enabled ? "enabled" : "disabled"}`);
     }
-    return json3({
+    return json12({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -2494,11 +3595,11 @@ async function modulesRoutes(req, url) {
 async function captureRoutes(req, url) {
   const p = url.pathname;
   if (p === "/api/capture/status" && req.method === "GET") {
-    return json3(capture.stats());
+    return json12(capture.stats());
   }
   if (p === "/api/capture/packets" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 200) || 200;
-    return json3({ packets: capture.recent(limit), stats: capture.stats() });
+    return json12({ packets: capture.recent(limit), stats: capture.stats() });
   }
   if (p === "/api/capture/pcap" && req.method === "GET") {
     return new Response(capture.pcap(), {
@@ -2510,11 +3611,11 @@ async function captureRoutes(req, url) {
   }
   if (p === "/api/capture/start" && req.method === "POST") {
     const body = await readJson(req);
-    return json3(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
+    return json12(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
   }
   if (p === "/api/capture/stop" && req.method === "POST") {
     capture.stop();
-    return json3({ ok: true, ...capture.stats() });
+    return json12({ ok: true, ...capture.stats() });
   }
   return null;
 }
@@ -2526,24 +3627,24 @@ async function capsmanRoutes(req, url) {
   if (req.method === "GET") {
     const ctx = createContext(undefined, url.searchParams.get("device") ?? undefined);
     if (p === "/api/capsman/overview") {
-      return json3(capsmanOverview(await fetchCapsmanState(ctx)));
+      return json12(capsmanOverview(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/clients") {
       const state = await fetchCapsmanState(ctx);
       const weakDbm = Number.parseInt(url.searchParams.get("weak_dbm") ?? "", 10);
       const weak = reportWeakClients(state, Number.isFinite(weakDbm) ? weakDbm : undefined);
-      return json3({ clients: state.clients, weak });
+      return json12({ clients: state.clients, weak });
     }
     if (p === "/api/capsman/audit") {
-      return json3(runCapsmanAudit(await fetchCapsmanState(ctx)));
+      return json12(runCapsmanAudit(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/trends") {
       if (!capsmanStore)
-        return json3({ error: "capsman store not active" }, 503);
+        return json12({ error: "capsman store not active" }, 503);
       const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
       const days = daysParam(url, 7, 30);
       const series = capsmanStore.radioSeries(device, Date.now() - days * 86400000);
-      return json3({ series, days });
+      return json12({ series, days });
     }
     return null;
   }
@@ -2554,45 +3655,45 @@ async function capsmanRoutes(req, url) {
     if (p === "/api/capsman/apply/steer") {
       const client = state.clients.find((c) => c.mac.toLowerCase() === (body.mac ?? "").toLowerCase());
       if (!client)
-        return json3({ ok: false, error: "client not associated" }, 400);
+        return json12({ ok: false, error: "client not associated" }, 400);
       if (steerAlreadyPresent(state, body.mac ?? "")) {
-        return json3({ ok: true, message: "already steered (no-op)" });
+        return json12({ ok: true, message: "already steered (no-op)" });
       }
       const mode = body.mode === "soft" ? "soft" : "hard";
       const commands = buildSteerCommands(state, body.mac ?? "", client.radioId, mode);
       if (!body.confirm)
-        return json3({ ok: true, preview: commands });
-      return json3(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
+        return json12({ ok: true, preview: commands });
+      return json12(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
     }
     if (p === "/api/capsman/apply/load-balance") {
       const plan = loadBalancePlan(state);
       const commands = buildLoadBalanceCommands(state, plan);
       if (!body.confirm)
-        return json3({ ok: true, preview: commands, plan });
-      return json3(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
+        return json12({ ok: true, preview: commands, plan });
+      return json12(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
     }
     if (p === "/api/capsman/apply/channel-plan") {
       if (state.path === "/caps-man") {
-        return json3({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
+        return json12({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
       }
       const commands = buildChannelPlanCommands(state);
       if (!body.confirm)
-        return json3({ ok: true, preview: commands });
-      return json3(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
+        return json12({ ok: true, preview: commands });
+      return json12(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
     }
     if (p === "/api/capsman/apply/ft") {
       const commands = buildFtCommands(state);
       if (!body.confirm)
-        return json3({ ok: true, preview: commands });
-      return json3(await applyCapsmanWrites(ctx, commands, "pre-ft"));
+        return json12({ ok: true, preview: commands });
+      return json12(await applyCapsmanWrites(ctx, commands, "pre-ft"));
     }
     if (p === "/api/capsman/apply/ha") {
       const commands = buildHaCommands(state);
       const guidance = haGuidance(state);
       if (!body.confirm)
-        return json3({ ok: true, preview: commands, guidance });
+        return json12({ ok: true, preview: commands, guidance });
       const res = await applyCapsmanWrites(ctx, commands, "pre-ha");
-      return json3({ ...res, guidance });
+      return json12({ ...res, guidance });
     }
   }
   return null;
@@ -2618,32 +3719,32 @@ async function clientsRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (p === "/api/clients" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json3(devicesView(await fetchDevices(ctx)));
+    return json12(devicesView(await fetchDevices(ctx)));
   }
   if (p === "/api/clients/traffic" && req.method === "GET") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json3({ error: "ip required" }, 400);
+      return json12({ error: "ip required" }, 400);
     const ctx = createContext(undefined, deviceFromQuery());
-    return json3(await sampleDeviceTraffic(ctx, ip));
+    return json12(await sampleDeviceTraffic(ctx, ip));
   }
   if (p === "/api/clients/traffic-bulk" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json3(await sampleAllTraffic(ctx));
+    return json12(await sampleAllTraffic(ctx));
   }
   if (req.method === "POST") {
     const b = await readJson(req);
     const ctx = createContext(undefined, b?.device);
     if (p === "/api/clients/limits") {
       if (!b?.ip)
-        return json3({ error: "ip required" }, 400);
-      return json3(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
+        return json12({ error: "ip required" }, 400);
+      return json12(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
     }
     if (!b?.mac)
-      return json3({ error: "mac required" }, 400);
+      return json12({ error: "mac required" }, 400);
     const run = async (op) => {
       const r = await op;
-      return json3({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
+      return json12({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
     };
     if (p === "/api/clients/block")
       return run(blockDevice(ctx, b.mac, b.comment));
@@ -2655,12 +3756,12 @@ async function clientsRoutes(req, url) {
       return run(removeDeviceLease(ctx, b.mac));
     if (p === "/api/clients/set-ip") {
       if (!b.ip)
-        return json3({ error: "ip required" }, 400);
+        return json12({ error: "ip required" }, 400);
       return run(setDeviceIp(ctx, b.mac, b.ip));
     }
     if (p === "/api/clients/label") {
       if (typeof b.label !== "string")
-        return json3({ error: "label required" }, 400);
+        return json12({ error: "label required" }, 400);
       return run(setDeviceLabel(ctx, b.mac, b.label));
     }
   }
@@ -2673,20 +3774,20 @@ async function aaaRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (req.method === "GET") {
     if (p === "/api/aaa/entities") {
-      return json3({ entities: AAA_ENTITIES });
+      return json12({ entities: AAA_ENTITIES });
     }
     if (p === "/api/aaa/radius-incoming") {
-      return json3(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
+      return json12(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
     }
     if (p === "/api/aaa/um-settings") {
-      return json3(await getUmSettings(createContext(undefined, deviceFromQuery())));
+      return json12(await getUmSettings(createContext(undefined, deviceFromQuery())));
     }
     const listMatch = p.match(/^\/api\/aaa\/list\/([\w-]+)$/);
     if (listMatch) {
       const slug = listMatch[1];
       if (!AAA_ENTITIES[slug])
-        return json3({ error: "unknown entity" }, 404);
-      return json3(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
+        return json12({ error: "unknown entity" }, 404);
+      return json12(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
     }
     return null;
   }
@@ -2694,30 +3795,30 @@ async function aaaRoutes(req, url) {
     const body = await readJson(req);
     const ctx = createContext(undefined, body?.device);
     if (p === "/api/aaa/radius-incoming")
-      return json3(await setRadiusIncoming(ctx, body?.fields ?? {}));
+      return json12(await setRadiusIncoming(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/um-settings")
-      return json3(await setUmSettings(ctx, body?.fields ?? {}));
+      return json12(await setUmSettings(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/radius-reset-counters")
-      return json3(await resetRadiusCounters(ctx));
+      return json12(await resetRadiusCounters(ctx));
     const slug = body?.slug ?? "";
     if (!AAA_ENTITIES[slug])
-      return json3({ error: "unknown entity" }, 404);
+      return json12({ error: "unknown entity" }, 404);
     if (p === "/api/aaa/add")
-      return json3(await addAaaEntity(ctx, slug, body?.fields ?? {}));
+      return json12(await addAaaEntity(ctx, slug, body?.fields ?? {}));
     if (p === "/api/aaa/update") {
       if (!body?.id)
-        return json3({ error: "id required" }, 400);
-      return json3(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
+        return json12({ error: "id required" }, 400);
+      return json12(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
     }
     if (p === "/api/aaa/remove") {
       if (!body?.id)
-        return json3({ error: "id required" }, 400);
-      return json3(await removeAaaEntity(ctx, slug, body.id));
+        return json12({ error: "id required" }, 400);
+      return json12(await removeAaaEntity(ctx, slug, body.id));
     }
     if (p === "/api/aaa/toggle") {
       if (!body?.id)
-        return json3({ error: "id required" }, 400);
-      return json3(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
+        return json12({ error: "id required" }, 400);
+      return json12(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
     }
   }
   return null;
@@ -2733,43 +3834,43 @@ async function usageRoutes(req, url) {
     return null;
   if (p === "/api/usage/sampler") {
     if (req.method === "GET")
-      return json3({ intervalMs: getUsageSamplerInterval() });
+      return json12({ intervalMs: getUsageSamplerInterval() });
     if (req.method === "POST") {
       const b = await readJson(req);
       const applied = setUsageSamplerInterval(Number(b?.intervalMs));
-      return json3({ intervalMs: applied });
+      return json12({ intervalMs: applied });
     }
     return null;
   }
   if (req.method !== "GET")
     return null;
   if (!usageStore)
-    return json3({ error: "usage store not active" }, 503);
+    return json12({ error: "usage store not active" }, 503);
   const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
   const sinceTs = (days) => Date.now() - days * 86400000;
   if (p === "/api/usage/um-users") {
-    return json3({ users: usageStore.umUsers(device) });
+    return json12({ users: usageStore.umUsers(device) });
   }
   if (p === "/api/usage/client") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json3({ error: "ip required" }, 400);
+      return json12({ error: "ip required" }, 400);
     const series = usageStore.clientDailyUsage(device, ip, sinceTs(daysParam(url, 90, 400)));
-    return json3(withTotals(series));
+    return json12(withTotals(series));
   }
   if (p === "/api/usage/um-user") {
     const user = url.searchParams.get("user");
     if (!user)
-      return json3({ error: "user required" }, 400);
+      return json12({ error: "user required" }, 400);
     const series = usageStore.umUserDailyUsage(device, user, sinceTs(daysParam(url, 90, 400)));
-    return json3(withTotals(series));
+    return json12(withTotals(series));
   }
   if (p === "/api/usage/heatmap") {
     const user = url.searchParams.get("user");
     const days = usageStore.heatmap(device, user || null, sinceTs(daysParam(url, 371, 400)));
     const total = days.reduce((s, d) => s + d.count, 0);
     const max = days.reduce((m, d) => Math.max(m, d.count), 0);
-    return json3({ days, total, max });
+    return json12({ days, total, max });
   }
   return null;
 }
@@ -2789,31 +3890,31 @@ function snapStore() {
 async function featureRoutes(req, url) {
   const p = url.pathname;
   if (p === "/api/snapshots" && req.method === "GET") {
-    const store = await snapStore();
+    const store3 = await snapStore();
     const cfg = getConfig();
-    const all = Object.keys(cfg.devices).flatMap((d) => store.list(d, 200, false));
+    const all = Object.keys(cfg.devices).flatMap((d) => store3.list(d, 200, false));
     all.sort((a, b) => b.ts - a.ts);
-    return json3({ snapshots: all });
+    return json12({ snapshots: all });
   }
   const snapMatch = p.match(/^\/api\/snapshot\/(.+)$/);
   if (snapMatch && req.method === "GET") {
-    const store = await snapStore();
-    const s = store.get(decodeURIComponent(snapMatch[1]));
-    return s ? json3(s) : json3({ error: "not found" }, 404);
+    const store3 = await snapStore();
+    const s = store3.get(decodeURIComponent(snapMatch[1]));
+    return s ? json12(s) : json12({ error: "not found" }, 404);
   }
   if (p === "/api/snapshots/diff" && req.method === "POST") {
-    const store = await snapStore();
+    const store3 = await snapStore();
     const b = await readJson(req);
-    const from = b?.from ? store.get(b.from) : null;
-    const to = b?.to ? store.get(b.to) : null;
+    const from = b?.from ? store3.get(b.from) : null;
+    const to = b?.to ? store3.get(b.to) : null;
     if (!from || !to) {
-      return json3({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
+      return json12({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
     }
     const diff = diffLines(normalizeExport(from.body), normalizeExport(to.body), {
       fromLabel: from.label ?? from.id,
       toLabel: to.label ?? to.id
     });
-    return json3({
+    return json12({
       from: { id: from.id, label: from.label, ts: from.ts, device: from.device },
       to: { id: to.id, label: to.label, ts: to.ts, device: to.device },
       summary: diff.summary,
@@ -2827,16 +3928,16 @@ async function featureRoutes(req, url) {
       ...b?.script ? splitCommands(b.script) : []
     ];
     if (commands.length === 0)
-      return json3({ error: "no commands provided" }, 400);
+      return json12({ error: "no commands provided" }, 400);
     const plan = buildChangePlan(commands);
-    return json3({ plan, text: renderPlan(plan) });
+    return json12({ plan, text: renderPlan(plan) });
   }
   if (p === "/api/s3" && req.method === "GET") {
-    return json3({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
+    return json12({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
   }
   if (p === "/api/s3/list" && req.method === "GET") {
     if (!isS3Configured())
-      return json3({ configured: false, objects: [] });
+      return json12({ configured: false, objects: [] });
     const prefix = url.searchParams.get("prefix") ?? "";
     try {
       const res = await getS3Client().list({ prefix: prefix || undefined, maxKeys: 1000 });
@@ -2845,42 +3946,42 @@ async function featureRoutes(req, url) {
         size: o.size ?? 0,
         lastModified: o.lastModified ?? null
       }));
-      return json3({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
+      return json12({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
     } catch (e) {
-      return json3({ error: clientError(e) }, 502);
+      return json12({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/presign" && req.method === "GET") {
     if (!isS3Configured())
-      return json3({ error: "S3 not configured" }, 400);
+      return json12({ error: "S3 not configured" }, 400);
     const key = url.searchParams.get("key");
     if (!key)
-      return json3({ error: "key required" }, 400);
+      return json12({ error: "key required" }, 400);
     try {
       const link = getS3Client().presign(key, { expiresIn: presignExpiresIn(), method: "GET" });
-      return json3({ url: link });
+      return json12({ url: link });
     } catch (e) {
-      return json3({ error: clientError(e) }, 502);
+      return json12({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/delete" && req.method === "POST") {
     if (!isS3Configured())
-      return json3({ error: "S3 not configured" }, 400);
+      return json12({ error: "S3 not configured" }, 400);
     const b = await readJson(req);
     if (!b?.key)
-      return json3({ error: "key required" }, 400);
+      return json12({ error: "key required" }, 400);
     try {
       const client = getS3Client();
       if (!await client.exists(b.key))
-        return json3({ error: "not found" }, 404);
+        return json12({ error: "not found" }, 404);
       await client.delete(b.key);
-      return json3({ ok: true, key: b.key });
+      return json12({ ok: true, key: b.key });
     } catch (e) {
-      return json3({ error: clientError(e) }, 502);
+      return json12({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/backups" && req.method === "GET") {
-    return json3({
+    return json12({
       dir: backupDir(),
       devices: Object.keys(getConfig().devices),
       backups: listBackups()
@@ -2890,14 +3991,14 @@ async function featureRoutes(req, url) {
     const b = await readJson(req);
     const raw = b?.dir?.trim();
     if (!raw)
-      return json3({ error: "dir required" }, 400);
+      return json12({ error: "dir required" }, 400);
     const dir = raw === "~" || raw.startsWith("~/") ? join4(homedir3(), raw.slice(1)) : raw;
     const next = { ...getConfig(), backupDir: dir };
     setConfig(next);
     try {
       atomicWrite(getConfigSource().path, serializeConfig(next));
     } catch (e) {
-      return json3({
+      return json12({
         ok: true,
         dir: backupDir(),
         persisted: false,
@@ -2905,16 +4006,16 @@ async function featureRoutes(req, url) {
       });
     }
     recordVersion(getConfig(), "auto", Date.now(), "backup path changed");
-    return json3({ ok: true, dir: backupDir(), persisted: true });
+    return json12({ ok: true, dir: backupDir(), persisted: true });
   }
   if (p === "/api/backups/get" && req.method === "GET") {
     const name = url.searchParams.get("name");
     if (!name)
-      return json3({ error: "name required" }, 400);
+      return json12({ error: "name required" }, 400);
     try {
-      return json3({ name, content: readBackup(name) });
+      return json12({ name, content: readBackup(name) });
     } catch {
-      return json3({ error: "not found" }, 404);
+      return json12({ error: "not found" }, 404);
     }
   }
   if (p === "/api/backups/raw" && req.method === "GET") {
@@ -2935,41 +4036,41 @@ async function featureRoutes(req, url) {
   if (p === "/api/backups/upload" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || typeof b.content !== "string") {
-      return json3({ error: "name and content are required" }, 400);
+      return json12({ error: "name and content are required" }, 400);
     }
     try {
       const safe = b.name.endsWith(".rsc") ? b.name : `${b.name}.rsc`;
-      return json3({ ok: true, name: writeBackup(safe, b.content) });
+      return json12({ ok: true, name: writeBackup(safe, b.content) });
     } catch (e) {
-      return json3({ error: clientError(e) }, 400);
+      return json12({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/rename" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || !b?.new_name)
-      return json3({ error: "name and new_name are required" }, 400);
+      return json12({ error: "name and new_name are required" }, 400);
     try {
-      return json3({ ok: true, name: renameBackup(b.name, b.new_name) });
+      return json12({ ok: true, name: renameBackup(b.name, b.new_name) });
     } catch (e) {
-      return json3({ error: clientError(e) }, 400);
+      return json12({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json3({ error: "name required" }, 400);
+      return json12({ error: "name required" }, 400);
     try {
-      return deleteBackup(b.name) ? json3({ ok: true }) : json3({ error: "not found" }, 404);
+      return deleteBackup(b.name) ? json12({ ok: true }) : json12({ error: "not found" }, 404);
     } catch (e) {
-      return json3({ error: clientError(e) }, 400);
+      return json12({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json3({ error: "name required" }, 400);
+      return json12({ error: "name required" }, 400);
     const device = resolveDeviceName(b.device);
-    return json3(await restoreLocalBackup(device, b.name, b.confirm === true));
+    return json12(await restoreLocalBackup(device, b.name, b.confirm === true));
   }
   if (p === "/api/backups/create" && req.method === "POST") {
     const b = await readJson(req);
@@ -2981,14 +4082,14 @@ async function featureRoutes(req, url) {
       compact: b?.compact === true,
       terse: b?.terse === true
     });
-    return r.ok ? json3(r) : json3({ error: r.error ?? "export failed" }, 502);
+    return r.ok ? json12(r) : json12({ error: r.error ?? "export failed" }, 502);
   }
   return null;
 }
 async function runDashboard(cfg, transportLabel) {
-  const store = await openSqliteStore(cfg.dbPath);
+  const store3 = await openSqliteStore(cfg.dbPath);
   configureRecorder({
-    store,
+    store: store3,
     capture: {
       captureBody: cfg.captureBody,
       maxBodyBytes: cfg.maxBodyBytes,
@@ -3000,13 +4101,13 @@ async function runDashboard(cfg, transportLabel) {
   startHealthChecks(30000);
   startGeoLookups();
   try {
-    usageStore = await openUsageStore(join4(dirname5(cfg.dbPath), "usage.db"));
+    usageStore = await openUsageStore(join4(dirname7(cfg.dbPath), "usage.db"));
     startUsageSampler(usageStore);
   } catch (e) {
     logger.warn(`[${SERVER_TAG3}] usage history disabled: ${String(e)}`);
   }
   try {
-    capsmanStore = await openCapsmanStore(join4(dirname5(cfg.dbPath), "capsman.db"));
+    capsmanStore = await openCapsmanStore(join4(dirname7(cfg.dbPath), "capsman.db"));
     startCapsmanSampler(capsmanStore);
   } catch (e) {
     logger.warn(`[${SERVER_TAG3}] capsman trends disabled: ${String(e)}`);
@@ -3080,12 +4181,39 @@ async function runDashboard(cfg, transportLabel) {
     const driftResp = await driftRoutes(req, url);
     if (driftResp)
       return driftResp;
+    const txnResp = await txnRoutes(req, url);
+    if (txnResp)
+      return txnResp;
+    const flowResp = await flowRoutes(req, url);
+    if (flowResp)
+      return flowResp;
+    const rolloutResp = await rolloutRoutes(req, url);
+    if (rolloutResp)
+      return rolloutResp;
+    const policyResp = await policyRoutes(req, url);
+    if (policyResp)
+      return policyResp;
+    const simResp = await simRoutes(req, url);
+    if (simResp)
+      return simResp;
+    const scheduleResp = await scheduleRoutes(req, url);
+    if (scheduleResp)
+      return scheduleResp;
+    const explainResp = await explainRoutes(req, url);
+    if (explainResp)
+      return explainResp;
+    const attackResp = await attackRoutes(req, url);
+    if (attackResp)
+      return attackResp;
+    const alertResp = await alertRoutes(req, url, getEventStore());
+    if (alertResp)
+      return alertResp;
     const memoryResp = await memoryRoutes(req, url);
     if (memoryResp)
       return memoryResp;
     const db = getEventStore();
     if (!db)
-      return json3({ error: "recorder not active" }, 503);
+      return json12({ error: "recorder not active" }, 503);
     if (url.pathname === "/api/events" && req.method === "DELETE") {
       let body = {};
       try {
@@ -3093,7 +4221,7 @@ async function runDashboard(cfg, transportLabel) {
       } catch {}
       const ids = Array.isArray(body.ids) ? body.ids.filter((x) => typeof x === "string") : [];
       const removed = body.all === true ? db.clear() : db.delete(ids);
-      return json3({ removed, total: db.total() });
+      return json12({ removed, total: db.total() });
     }
     if (url.pathname === "/api/ssh-pool") {
       const cfg2 = getConfig();
@@ -3102,7 +4230,7 @@ async function runDashboard(cfg, transportLabel) {
       const totalInflight = ps.reduce((s, p) => s + p.inflight, 0);
       const totalIdle = ps.filter((p) => p.idle).length;
       const totalBusy = ps.filter((p) => p.inflight > 0).length;
-      return json3({
+      return json12({
         enabled,
         config: {
           keepAlive: cfg2.ssh.keepAlive,
@@ -3131,16 +4259,39 @@ async function runDashboard(cfg, transportLabel) {
       });
     }
     if (url.pathname === "/api/devices") {
-      return json3(devicesPayload(db));
+      return json12(devicesPayload(db));
+    }
+    if (url.pathname === "/api/capabilities") {
+      const devices = Object.keys(getConfig().devices).map((name) => ({
+        device: name,
+        capabilities: serializeCapabilities(peekCapabilities(name))
+      }));
+      return json12({ devices });
+    }
+    if (url.pathname === "/api/capabilities/refresh" && req.method === "POST") {
+      const b = await readJson(req);
+      if (typeof b?.device !== "string")
+        return json12({ error: "device (string) is required" }, 400);
+      if (!(b.device in getConfig().devices)) {
+        return json12({ error: `unknown device: ${b.device}` }, 404);
+      }
+      invalidateCapabilities(b.device);
+      try {
+        const caps = await getCapabilities(b.device);
+        return json12({ device: b.device, capabilities: serializeCapabilities(caps) });
+      } catch (e) {
+        logger.error(`Capability probe failed for '${b.device}': ${logError(e)}`);
+        return json12({ error: clientError(e) }, 502);
+      }
     }
     if (url.pathname === "/api/devices/toggle" && req.method === "POST") {
       const b = await readJson(req);
       if (typeof b?.device !== "string" || typeof b?.disabled !== "boolean") {
-        return json3({ error: "device (string) and disabled (boolean) are required" }, 400);
+        return json12({ error: "device (string) and disabled (boolean) are required" }, 400);
       }
       const cfg2 = getConfig();
       if (!(b.device in cfg2.devices))
-        return json3({ error: `unknown device: ${b.device}` }, 404);
+        return json12({ error: `unknown device: ${b.device}` }, 404);
       const dc = cfg2.devices[b.device];
       const next = {
         ...cfg2,
@@ -3161,7 +4312,7 @@ async function runDashboard(cfg, transportLabel) {
       if (persisted) {
         recordVersion(getConfig(), "auto", Date.now(), `device ${b.disabled ? "disabled" : "enabled"}: ${b.device}`);
       }
-      return json3({
+      return json12({
         ok: true,
         persisted,
         requiresReconnect: true,
@@ -3174,17 +4325,17 @@ async function runDashboard(cfg, transportLabel) {
       const name = typeof b?.device === "string" ? b.device : "";
       const cfg2 = getConfig();
       if (!(name in cfg2.devices))
-        return json3({ error: `unknown device: ${name}` }, 404);
+        return json12({ error: `unknown device: ${name}` }, 404);
       if (url.pathname === "/api/devices/reconnect")
         closeDevice(name);
       const status = await probeDevice(name, cfg2.devices[name]);
-      return json3({ ok: true, status, ...devicesPayload(db) });
+      return json12({ ok: true, status, ...devicesPayload(db) });
     }
     if (url.pathname === "/api/topology") {
-      return json3(topologyPayload());
+      return json12(topologyPayload());
     }
     if (url.pathname === "/api/config") {
-      return json3(configPayload());
+      return json12(configPayload());
     }
     if (url.pathname === "/" || url.pathname === "/index.html") {
       return new Response(dashboardHtml(), {
@@ -3193,9 +4344,9 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases/latest") {
       try {
-        return json3(await fetchLatestRelease());
+        return json12(await fetchLatestRelease());
       } catch (e) {
-        return json3({ error: clientError(e, "fetch failed") }, 502);
+        return json12({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/catalog" && req.method === "GET") {
@@ -3214,7 +4365,7 @@ async function runDashboard(cfg, transportLabel) {
       }));
       const prompts = listPrompts();
       const groups = [...new Set(modules.map((m) => m.group))].sort();
-      return json3({
+      return json12({
         modules,
         prompts,
         groups,
@@ -3229,25 +4380,25 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases" && req.method === "GET") {
       try {
-        return json3(await fetchAllReleases());
+        return json12(await fetchAllReleases());
       } catch (e) {
-        return json3({ error: clientError(e, "fetch failed") }, 502);
+        return json12({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/upgrade" && req.method === "POST") {
       const body = await readJson(req);
       const version = String(body?.version ?? "latest");
       if (version !== "latest" && !/^\d+\.\d+\.\d+$/.test(version)) {
-        return json3({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
+        return json12({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
       }
       const spec = `@usex/mikrotik-mcp@${version}`;
       logger.warn(`Dashboard requested upgrade: bun i -g ${spec}`);
       const { ok, log } = await runUpgrade(spec);
       if (!ok)
-        return json3({ ok: false, version, log }, 500);
+        return json12({ ok: false, version, log }, 500);
       const willRestart = body?.restart !== false;
       const relaunched = willRestart ? restartProcess() : false;
-      return json3({
+      return json12({
         ok: true,
         version,
         log,
@@ -3257,7 +4408,7 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/meta") {
       const f = facets(db);
-      return json3({
+      return json12({
         ...f,
         version: VERSION,
         risks: ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"],
@@ -3268,19 +4419,19 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/events") {
       const filter = filterFromQuery(url);
-      return json3({ events: db.query(filter), total: db.total() });
+      return json12({ events: db.query(filter), total: db.total() });
     }
     const eventMatch = url.pathname.match(/^\/api\/event\/(.+)$/);
     if (eventMatch) {
       const e = db.get(decodeURIComponent(eventMatch[1]));
-      return e ? json3(e) : json3({ error: "not found" }, 404);
+      return e ? json12(e) : json12({ error: "not found" }, 404);
     }
     if (url.pathname === "/api/stats") {
       const now = Date.now();
-      const windowMs = Number(url.searchParams.get("window") ?? 3600000);
+      const windowMs2 = Number(url.searchParams.get("window") ?? 3600000);
       const buckets = Number(url.searchParams.get("buckets") ?? 60);
-      const events = db.query({ since: now - windowMs, limit: 5000 });
-      return json3(computeStats(events, { now, windowMs, buckets }));
+      const events = db.query({ since: now - windowMs2, limit: 5000 });
+      return json12(computeStats(events, { now, windowMs: windowMs2, buckets }));
     }
     return new Response("Not Found", { status: 404 });
   }
@@ -3299,7 +4450,7 @@ async function runDashboard(cfg, transportLabel) {
         return await dashboardRoute(req, url, srv, configAdmin, transportLabel);
       } catch (e) {
         logger.error(`Dashboard request failed (${url.pathname}): ${logError(e)}`);
-        return json3({ error: clientError(e) }, 502);
+        return json12({ error: clientError(e) }, 502);
       }
     },
     websocket: {
@@ -3311,11 +4462,19 @@ async function runDashboard(cfg, transportLabel) {
             } catch {}
           });
         } else {
-          ws.data.unsub = subscribe((e) => {
+          const send = (payload2) => {
             try {
-              ws.send(JSON.stringify({ type: "event", event: e }));
+              ws.send(JSON.stringify(payload2));
             } catch {}
-          });
+          };
+          const unsubEvents = subscribe((e) => send({ type: "event", event: e }));
+          const unsubTxn = subscribeTxn((update) => send({ type: "txn", update }));
+          const unsubRollout = subscribeRollout((update) => send({ type: "rollout", update }));
+          ws.data.unsub = () => {
+            unsubEvents();
+            unsubTxn();
+            unsubRollout();
+          };
         }
         ws.send(JSON.stringify({ type: "hello", transport: transportLabel }));
       },
@@ -3336,14 +4495,14 @@ async function runDashboard(cfg, transportLabel) {
   }
   return {
     server,
-    store,
+    store: store3,
     stop() {
       stopHealthChecks();
       stopGeoLookups();
       stopUsageSampler();
       stopCapsmanSampler();
       server.stop(true);
-      store.close();
+      store3.close();
       usageStore?.close();
       usageStore = null;
       capsmanStore?.close();
@@ -3660,6 +4819,12 @@ async function runStdio() {
   const transport = new StdioServerTransport;
   await server.connect(transport);
   logger.info(`MCP server ready on stdio \u2014 ${toolCount} tools, ${promptCount} prompts, ${uiViewCount} app views${readOnly ? " [READ-ONLY]" : ""}`);
+  setMcpAlertSender((n) => {
+    server.server.sendLoggingMessage({
+      level: n.severity === "critical" || n.severity === "high" ? "error" : "info",
+      data: `[alert:${n.kind}] ${n.title}${n.device ? ` \xB7 ${n.device}` : ""} ` + `(severity ${n.severity}, rule ${n.ruleId})${n.body ? ` \u2014 ${n.body}` : ""}`
+    }).catch(() => {});
+  });
   if (!getConfig().disableUpdateCheck) {
     whisperUpdate(server).catch(() => {});
   }
@@ -3730,6 +4895,100 @@ async function printBanner() {
   }
 }
 
+// src/alerts/sampler.ts
+var DEFAULT_ALERT_SAMPLE_MS = 30000;
+var timer4 = null;
+var snapshotStorePromise = null;
+function getSnapshotStore() {
+  snapshotStorePromise ??= openSnapshotStore(DEFAULT_SNAPSHOT_DB);
+  return snapshotStorePromise;
+}
+function computeMetricSample(windowMs2, now = Date.now()) {
+  const store3 = getEventStore();
+  if (!store3)
+    return { calls: 0, errors: 0, avgDurationMs: 0, p95DurationMs: 0 };
+  const events = store3.query({ since: now - windowMs2, limit: 1e4 });
+  const calls = events.length;
+  if (calls === 0)
+    return { calls: 0, errors: 0, avgDurationMs: 0, p95DurationMs: 0 };
+  const durations = events.map((e) => e.durationMs);
+  return {
+    calls,
+    errors: events.reduce((n, e) => n + (e.isError ? 1 : 0), 0),
+    avgDurationMs: durations.reduce((a, b) => a + b, 0) / calls,
+    p95DurationMs: percentile(durations, 95)
+  };
+}
+async function lastSeen(t) {
+  switch (t.absence) {
+    case "tool_call": {
+      const store3 = getEventStore();
+      if (!store3)
+        return;
+      const rows = store3.query({
+        limit: 1,
+        tool: t.tool?.length === 1 ? t.tool[0] : undefined,
+        device: t.device?.length === 1 ? t.device[0] : undefined
+      });
+      return rows[0]?.ts;
+    }
+    case "snapshot": {
+      const devices = t.device?.length ? t.device : Object.keys(getConfig().devices);
+      let newest;
+      try {
+        const store3 = await getSnapshotStore();
+        for (const d of devices) {
+          const at = store3.latest(d)?.ts;
+          if (at !== undefined && (newest === undefined || at > newest))
+            newest = at;
+        }
+      } catch (e) {
+        logger.debug(`[alerts] snapshot lookup failed: ${e instanceof Error ? e.message : e}`);
+        return Date.now();
+      }
+      return newest;
+    }
+    case "device_seen": {
+      const devices = t.device?.length ? t.device : Object.keys(getConfig().devices);
+      let newest;
+      for (const d of devices) {
+        const st = getDeviceStatus(d);
+        if (st.reachable !== true || st.checkedAt == null)
+          continue;
+        if (newest === undefined || st.checkedAt > newest)
+          newest = st.checkedAt;
+      }
+      return newest;
+    }
+  }
+}
+async function sampleAlertsOnce(now = Date.now()) {
+  const engine = getAlertEngine();
+  if (!engine)
+    return;
+  if (engine.hasMetricRules()) {
+    engine.sample((windowMs2) => computeMetricSample(windowMs2, now));
+  }
+  if (engine.hasAbsenceRules()) {
+    await engine.sampleAbsence(lastSeen, now);
+  }
+}
+function startAlertSampler(intervalMs = DEFAULT_ALERT_SAMPLE_MS) {
+  stopAlertSampler();
+  timer4 = setInterval(() => {
+    sampleAlertsOnce().catch((e) => {
+      logger.debug(`[alerts] sampler tick failed: ${e instanceof Error ? e.message : String(e)}`);
+    });
+  }, intervalMs);
+  timer4.unref?.();
+  logger.debug(`[alerts] metric sampler started (${intervalMs}ms)`);
+}
+function stopAlertSampler() {
+  if (timer4)
+    clearInterval(timer4);
+  timer4 = null;
+}
+
 // src/cli.ts
 var HELP = `${SERVER_NAME} v${VERSION} \u2014 MikroTik RouterOS MCP server
 
@@ -3882,6 +5141,29 @@ async function main() {
   warnIfPlaintextPasswordInContainer(Object.values(cfg.devices).some((d) => !!d.password));
   const deviceNames = Object.keys(cfg.devices);
   logger.info(`Starting ${SERVER_NAME} v${VERSION} (transport=${cfg.mcp.transport}, ` + `devices=${deviceNames.length === 1 ? deviceNames[0] : deviceNames.join("/")}, ` + `ssh-pool=${cfg.ssh.keepAlive ? "on" : "off"})`);
+  if (cfg.alerts?.enabled !== false && cfg.alerts) {
+    try {
+      const rules = parseRules(cfg.alerts.rules);
+      setAlertEngine(new AlertEngine({
+        rules,
+        channels: cfg.alerts.channels,
+        historyDb: cfg.dashboard.dbPath,
+        maxHistory: cfg.alerts.maxHistory
+      }));
+      startAlertSampler();
+      logger.info(`Alerting enabled: ${rules.length} rule(s)`);
+    } catch (e) {
+      logger.error(`Alerting disabled \u2014 invalid rules: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  startScheduler().catch((e) => {
+    logger.error(`Scheduled audits disabled: ${e instanceof Error ? e.message : String(e)}`);
+  });
+  try {
+    startAttackDetection();
+  } catch (e) {
+    logger.error(`Attack detection disabled: ${e instanceof Error ? e.message : String(e)}`);
+  }
   let shuttingDown = false;
   const shutdown = (signal) => {
     if (shuttingDown)
@@ -3890,6 +5172,9 @@ async function main() {
     logger.info(`Received ${signal}, shutting down\u2026`);
     closeAll();
     closeMemoryStore();
+    stopAlertSampler();
+    stopScheduler();
+    stopAttackDetection();
     process.exit(0);
   };
   process.on("SIGINT", () => shutdown("SIGINT"));