@usex/mikrotik-mcp 5.3.0 → 5.5.0

package/dist/cli.js

@@ -2,6 +2,8 @@
 // @bun
 import {
   AAA_ENTITIES,
+  ADVISORIES,
+  ADVISORY_DATASET_DATE,
   ALWAYS_ON_MODULES,
   AlertEngine,
   AlertRuleSchema,
@@ -40,6 +42,7 @@ import {
   blockDevice,
   buildChangePlan,
   buildChannelPlanCommands,
+  buildFabricMap,
   buildFtCommands,
   buildGuards,
   buildHaCommands,
@@ -54,6 +57,8 @@ import {
   closeAll,
   closeDevice,
   closeMemoryStore,
+  collectDeviceFacts,
+  collectFabric,
   commandUnsupported,
   configureRecorder,
   conversations,
@@ -89,6 +94,7 @@ import {
   fetchLatestRelease,
   flowStore,
   forgetJob,
+  getAccessPolicy,
   getAlertEngine,
   getCapabilities,
   getConfig,
@@ -129,6 +135,7 @@ import {
   logger,
   looksLikeError,
   makeDeviceStatic,
+  matchAdvisories,
   moduleCatalog,
   neverBlockSet,
   nextRun,
@@ -154,6 +161,7 @@ import {
   protocolMix,
   publishRollout,
   readBackup,
+  recentDenials,
   redact,
   redactChannels,
   registerTools,
@@ -230,7 +238,7 @@ import {
   validatePolicyText,
   worstSeverity,
   writeBackup
-} from "./shared/cli-54yv0kd3.js";
+} from "./shared/cli-cvq8pxvn.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1688,11 +1696,64 @@ async function driftRoutes(req, url) {
   return null;
 }
 
-// src/observability/txn-routes.ts
+// src/observability/posture-routes.ts
 var JSON_HEADERS2 = { "content-type": "application/json; charset=utf-8" };
 function json2(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS2 });
 }
+async function postureRoutes(req, url) {
+  const p = url.pathname;
+  if (req.method !== "GET")
+    return null;
+  if (p === "/api/fabric") {
+    const device = url.searchParams.get("device") ?? undefined;
+    const ctx = createContext(undefined, device);
+    try {
+      const map = buildFabricMap(await collectFabric(device, ctx));
+      return json2(map);
+    } catch (e) {
+      return json2({ error: e instanceof Error ? e.message : String(e) }, 502);
+    }
+  }
+  if (p === "/api/advisories") {
+    const all = url.searchParams.get("all") === "1";
+    const device = url.searchParams.get("device") ?? undefined;
+    const targets = all ? listDevices().names : [device];
+    try {
+      const facts = await Promise.all(targets.map((d) => collectDeviceFacts(d)));
+      const report = matchAdvisories(facts);
+      return json2({
+        ...report,
+        datasetDate: ADVISORY_DATASET_DATE,
+        datasetSize: ADVISORIES.length,
+        devices: facts.map((f) => ({
+          device: f.device,
+          version: f.version,
+          board: f.board,
+          enabledServices: f.services.filter((s) => !s.disabled).length,
+          unrestrictedServices: f.services.filter((s) => !s.disabled && s.allowedFrom.length === 0).length
+        }))
+      });
+    } catch (e) {
+      return json2({ error: e instanceof Error ? e.message : String(e) }, 502);
+    }
+  }
+  if (p === "/api/access") {
+    const policy = getAccessPolicy();
+    return json2({
+      enabled: policy.enabled,
+      scope: policy.scope,
+      denials: recentDenials(50)
+    });
+  }
+  return null;
+}
+
+// src/observability/txn-routes.ts
+var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
+function json3(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
+}
 function liveRecord(id) {
   const entry = getTxn(id);
   return entry ? { ...toRecord(entry.txn, entry.ts, entry.label), updated: Date.now() } : null;
@@ -1717,16 +1778,16 @@ async function txnRoutes(req, url) {
     for (const r of live)
       byId.set(r.id, r);
     const transactions = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
-    return json2({ transactions, live: liveTxnUpdates(), error: storeError });
+    return json3({ transactions, live: liveTxnUpdates(), error: storeError });
   }
   const parts = p.slice("/api/txn/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json2({ error: "not found" }, 404);
+    return json3({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   if (parts[1] === "abort" && req.method === "POST") {
     const entry = getTxn(id);
     if (!entry)
-      return json2({ error: `no open transaction '${id}'` }, 404);
+      return json3({ error: `no open transaction '${id}'` }, 404);
     entry.txn = requestAbort(entry.txn, "aborted from the dashboard");
     const run = await runTransaction({
       txn: entry.txn,
@@ -1737,7 +1798,7 @@ async function txnRoutes(req, url) {
     await persistTxn(entry);
     if (run.state !== undefined)
       dropTxn(id);
-    return json2({
+    return json3({
       state: run.state,
       summary: run.summary,
       transaction: toRecord(run.txn, entry.ts)
@@ -1746,16 +1807,16 @@ async function txnRoutes(req, url) {
   if (parts.length === 1 && req.method === "GET") {
     const record = liveRecord(id) ?? store?.get(id) ?? null;
     if (!record)
-      return json2({ error: `unknown transaction '${id}'` }, 404);
-    return json2({ transaction: record, events: store?.events(id) ?? [] });
+      return json3({ error: `unknown transaction '${id}'` }, 404);
+    return json3({ transaction: record, events: store?.events(id) ?? [] });
   }
-  return json2({ error: "method not allowed" }, 405);
+  return json3({ error: "method not allowed" }, 405);
 }
 
 // src/observability/flow-routes.ts
-var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
-function json3(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
+var JSON_HEADERS4 = { "content-type": "application/json; charset=utf-8" };
+function json4(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS4 });
 }
 var WINDOWS = {
   "5m": 5 * 60000,
@@ -1775,14 +1836,14 @@ async function flowRoutes(req, url) {
   if (!p.startsWith("/api/flows"))
     return null;
   if (req.method !== "GET")
-    return json3({ error: "method not allowed" }, 405);
+    return json4({ error: "method not allowed" }, 405);
   const collector = getFlowCollector();
   if (p === "/api/flows/health") {
     let store = null;
     try {
       store = (await flowStore()).stats();
     } catch {}
-    return json3({ collector: collector.stats(), store });
+    return json4({ collector: collector.stats(), store });
   }
   collector.drain();
   let records;
@@ -1793,12 +1854,12 @@ async function flowRoutes(req, url) {
   try {
     records = (await flowStore()).query({ from, to, address, limit: 200000 });
   } catch (e) {
-    return json3({ error: e instanceof Error ? e.message : String(e), records: [] }, 200);
+    return json4({ error: e instanceof Error ? e.message : String(e), records: [] }, 200);
   }
   if (p === "/api/flows/top") {
     const dimension = url.searchParams.get("dimension") ?? "source";
     const limit = Number(url.searchParams.get("limit") ?? 10);
-    return json3({
+    return json4({
       window: { from, to },
       totals: summarize(records),
       top: topTalkers(records, dimension, limit, true),
@@ -1808,7 +1869,7 @@ async function flowRoutes(req, url) {
   }
   if (p === "/api/flows/conversations") {
     const limit = Number(url.searchParams.get("limit") ?? 20);
-    return json3({
+    return json4({
       window: { from, to },
       conversations: conversations(records, limit)
     });
@@ -1817,20 +1878,20 @@ async function flowRoutes(req, url) {
     const dimension = url.searchParams.get("dimension") ?? "source";
     const topN = Number(url.searchParams.get("topN") ?? 5);
     const bucket = bucketFor(span);
-    return json3({
+    return json4({
       window: { from, to },
       bucketMs: bucket,
       keys: topTalkers(records, dimension, topN).map((t) => t.key),
       buckets: timeline(records, from, to, bucket, dimension, topN)
     });
   }
-  return json3({ error: "not found" }, 404);
+  return json4({ error: "not found" }, 404);
 }
 
 // src/observability/rollout-routes.ts
-var JSON_HEADERS4 = { "content-type": "application/json; charset=utf-8" };
-function json4(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS4 });
+var JSON_HEADERS5 = { "content-type": "application/json; charset=utf-8" };
+function json5(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS5 });
 }
 function liveRecord2(id) {
   const entry = getRollout(id);
@@ -1859,17 +1920,17 @@ async function rolloutRoutes(req, url) {
     for (const r of live)
       byId.set(r.id, r);
     const rollouts = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
-    return json4({ rollouts, live: liveRolloutUpdates(), error: storeError });
+    return json5({ rollouts, live: liveRolloutUpdates(), error: storeError });
   }
   const parts = p.slice("/api/rollout/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json4({ error: "not found" }, 404);
+    return json5({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   const verb = parts[1];
   if (verb && req.method === "POST") {
     const entry = getRollout(id);
     if (!entry)
-      return json4({ error: `no active rollout '${id}'` }, 404);
+      return json5({ error: `no active rollout '${id}'` }, 404);
     switch (verb) {
       case "hold": {
         entry.state = requestHold(entry.state);
@@ -1884,7 +1945,7 @@ async function rolloutRoutes(req, url) {
           devices: entry.state.devices,
           gates: entry.state.gates
         });
-        return json4({ held: true, summary: summarize2(entry.state) });
+        return json5({ held: true, summary: summarize2(entry.state) });
       }
       case "resume": {
         entry.state = resume(entry.state);
@@ -1912,7 +1973,7 @@ async function rolloutRoutes(req, url) {
         await persistRollout(entry);
         if (run.outcome)
           dropRollout(id);
-        return json4({ outcome: run.outcome, summary: run.summary });
+        return json5({ outcome: run.outcome, summary: run.summary });
       }
       case "abort": {
         entry.state = requestAbort2(entry.state, "aborted from the dashboard");
@@ -1925,19 +1986,19 @@ async function rolloutRoutes(req, url) {
         await persistRollout(entry);
         if (run.outcome)
           dropRollout(id);
-        return json4({ outcome: run.outcome, summary: run.summary });
+        return json5({ outcome: run.outcome, summary: run.summary });
       }
       default:
-        return json4({ error: `unknown action '${verb}'` }, 404);
+        return json5({ error: `unknown action '${verb}'` }, 404);
     }
   }
   if (parts.length === 1 && req.method === "GET") {
     const record = liveRecord2(id) ?? store?.get(id) ?? null;
     if (!record)
-      return json4({ error: `unknown rollout '${id}'` }, 404);
-    return json4({ rollout: record, events: store?.events(id) ?? [] });
+      return json5({ error: `unknown rollout '${id}'` }, 404);
+    return json5({ rollout: record, events: store?.events(id) ?? [] });
   }
-  return json4({ error: "method not allowed" }, 405);
+  return json5({ error: "method not allowed" }, 405);
 }
 
 // src/policy/results.ts
@@ -2026,9 +2087,9 @@ async function policyResults(device, limit = 50) {
 }
 
 // src/observability/policy-routes.ts
-var JSON_HEADERS5 = { "content-type": "application/json; charset=utf-8" };
-function json5(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS5 });
+var JSON_HEADERS6 = { "content-type": "application/json; charset=utf-8" };
+function json6(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS6 });
 }
 async function bodyJson2(req) {
   return await req.json().catch(() => ({}));
@@ -2039,7 +2100,7 @@ async function policyRoutes(req, url) {
     return null;
   if (p === "/api/policies" && req.method === "GET") {
     const set = currentPolicySet();
-    return json5({
+    return json6({
       files: set.files.map((f) => ({
         path: f.path,
         name: f.name,
@@ -2060,21 +2121,21 @@ async function policyRoutes(req, url) {
     try {
       results = await policyResults(device, limit);
     } catch (e) {
-      return json5({ results: [], error: e instanceof Error ? e.message : String(e) });
+      return json6({ results: [], error: e instanceof Error ? e.message : String(e) });
     }
-    return json5({ results });
+    return json6({ results });
   }
   if (p === "/api/policies/validate" && req.method === "POST") {
     const body = await bodyJson2(req);
     if (typeof body.content !== "string")
-      return json5({ error: "content is required" }, 400);
-    return json5(validatePolicyText(body.content));
+      return json6({ error: "content is required" }, 400);
+    return json6(validatePolicyText(body.content));
   }
   if (p === "/api/policies/run" && req.method === "POST") {
     const body = await bodyJson2(req);
     const set = currentPolicySet();
     if (set.policies.length === 0) {
-      return json5({ error: "no policy rules are loaded", reports: [] });
+      return json6({ error: "no policy rules are loaded", reports: [] });
     }
     const cfg = getConfig();
     const devices = body.devices && body.devices.length > 0 ? body.devices : Object.entries(cfg.devices).filter(([, d]) => !d.disabled).map(([name]) => name);
@@ -2103,9 +2164,9 @@ async function policyRoutes(req, url) {
         reports.push({ device, error: e instanceof Error ? e.message : String(e) });
       }
     }
-    return json5({ reports });
+    return json6({ reports });
   }
-  return json5({ error: "not found" }, 404);
+  return json6({ error: "not found" }, 404);
 }
 
 // src/sim/suites.ts
@@ -2198,9 +2259,9 @@ async function saveSuite(input) {
 }
 
 // src/observability/sim-routes.ts
-var JSON_HEADERS6 = { "content-type": "application/json; charset=utf-8" };
-function json6(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS6 });
+var JSON_HEADERS7 = { "content-type": "application/json; charset=utf-8" };
+function json7(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS7 });
 }
 async function bodyJson3(req) {
   return await req.json().catch(() => ({}));
@@ -2232,28 +2293,28 @@ async function simRoutes(req, url) {
   if (!p.startsWith("/api/sim"))
     return null;
   if (p === "/api/sim/suites" && req.method === "GET") {
-    return json6({ suites: await listSuites() });
+    return json7({ suites: await listSuites() });
   }
   if (p === "/api/sim/suites" && req.method === "POST") {
     const body = await bodyJson3(req);
     if (!body.name || !Array.isArray(body.packets) || body.packets.length === 0) {
-      return json6({ error: "name and a non-empty packets array are required" }, 400);
+      return json7({ error: "name and a non-empty packets array are required" }, 400);
     }
     const saved = await saveSuite({
       id: body.id,
       name: body.name,
       packets: body.packets
     });
-    return json6({ suite: saved });
+    return json7({ suite: saved });
   }
   if (p === "/api/sim/packet" && req.method === "POST") {
     const body = await bodyJson3(req);
     const config = await configFor(body);
     if ("error" in config)
-      return json6(config, 400);
+      return json7(config, 400);
     const model = buildModel(config.text);
     const result = tracePacket({ model, packet: body.packet });
-    return json6({
+    return json7({
       source: config.source,
       result,
       coverage: {
@@ -2267,16 +2328,16 @@ async function simRoutes(req, url) {
     const body = await bodyJson3(req);
     const config = await configFor(body);
     if ("error" in config)
-      return json6(config, 400);
+      return json7(config, 400);
     if (!body.changes || body.changes.trim() === "") {
-      return json6({ error: "changes are required" }, 400);
+      return json7({ error: "changes are required" }, 400);
     }
     const before = tracePacket({ model: buildModel(config.text), packet: body.packet });
     const afterModel = buildModel(`${config.text}
 ${body.changes}
 `);
     const after = tracePacket({ model: afterModel, packet: body.packet });
-    return json6({
+    return json7({
       source: config.source,
       before,
       after,
@@ -2291,10 +2352,10 @@ ${body.changes}
       packet: {}
     });
     if ("error" in config)
-      return json6(config, 400);
+      return json7(config, 400);
     const model = buildModel(config.text);
     const dead = unreachableRules(model.filter);
-    return json6({
+    return json7({
       source: config.source,
       rules: model.filter.map((r) => ({
         chain: r.chain,
@@ -2315,11 +2376,11 @@ ${body.changes}
     const id = decodeURIComponent(p.slice("/api/sim/suite/".length, -"/run".length));
     const suite = await getSuite(id);
     if (!suite)
-      return json6({ error: `no suite '${id}'` }, 404);
+      return json7({ error: `no suite '${id}'` }, 404);
     const body = await bodyJson3(req);
     const config = await configFor({ ...body, packet: {} });
     if ("error" in config)
-      return json6(config, 400);
+      return json7(config, 400);
     const model = buildModel(config.text);
     const results = suite.packets.map((entry) => {
       const result = tracePacket({ model, packet: entry.packet });
@@ -2331,7 +2392,7 @@ ${body.changes}
         summary: result.summary
       };
     });
-    return json6({
+    return json7({
       source: config.source,
       suite: { id: suite.id, name: suite.name },
       results,
@@ -2339,13 +2400,13 @@ ${body.changes}
       total: results.length
     });
   }
-  return json6({ error: "not found" }, 404);
+  return json7({ error: "not found" }, 404);
 }
 
 // src/observability/schedule-routes.ts
-var JSON_HEADERS7 = { "content-type": "application/json; charset=utf-8" };
-function json7(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS7 });
+var JSON_HEADERS8 = { "content-type": "application/json; charset=utf-8" };
+function json8(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS8 });
 }
 function latestPerDevice(runs) {
   const latest = new Map;
@@ -2421,12 +2482,12 @@ async function scheduleRoutes(req, url) {
   try {
     store3 = await scheduleStore();
   } catch (e) {
-    return json7({ error: e instanceof Error ? e.message : String(e), jobs: [] }, 503);
+    return json8({ error: e instanceof Error ? e.message : String(e), jobs: [] }, 503);
   }
   const now = Date.now();
   if (p === "/api/schedules" && req.method === "GET") {
     const jobs = store3.listJobs().map((job) => jobRow(job, store3.runs(job.id, 500), now));
-    return json7({
+    return json8({
       jobs,
       schedulable: schedulableTools().map((a) => ({ tool: a.tool, summary: a.summary }))
     });
@@ -2434,20 +2495,20 @@ async function scheduleRoutes(req, url) {
   if (p === "/api/schedules" && req.method === "POST") {
     const body = await req.json().catch(() => null);
     if (!body)
-      return json7({ error: "invalid JSON body" }, 400);
+      return json8({ error: "invalid JSON body" }, 400);
     const parsed = JobSchema.safeParse(body);
     if (!parsed.success) {
-      return json7({
+      return json8({
         error: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")
       }, 400);
     }
     if (!auditAdapter(parsed.data.tool)) {
-      return json7({ error: `'${parsed.data.tool}' is not a schedulable auditor` }, 400);
+      return json8({ error: `'${parsed.data.tool}' is not a schedulable auditor` }, 400);
     }
     await primeRiskIndex();
     const risk = liveExecutor().riskOf(parsed.data.tool);
     if (risk !== "READ") {
-      return json7({ error: `'${parsed.data.tool}' is annotated ${risk}; only READ may be scheduled` }, 400);
+      return json8({ error: `'${parsed.data.tool}' is annotated ${risk}; only READ may be scheduled` }, 400);
     }
     const existing = store3.getJob(parsed.data.id);
     const job = { ...parsed.data, createdAt: existing?.createdAt ?? now };
@@ -2456,7 +2517,7 @@ async function scheduleRoutes(req, url) {
       armJob(job, now);
     else
       forgetJob(job.id);
-    return json7({ job: jobRow(job, store3.runs(job.id, 500), now), replaced: existing !== null });
+    return json8({ job: jobRow(job, store3.runs(job.id, 500), now), replaced: existing !== null });
   }
   if (p === "/api/schedules/timeline" && req.method === "GET") {
     const jobId = url.searchParams.get("job") ?? undefined;
@@ -2464,7 +2525,7 @@ async function scheduleRoutes(req, url) {
     const days = Number(url.searchParams.get("days") ?? 30);
     const since = now - days * 86400000;
     const runs = store3.runs(jobId, 2000).filter((r) => r.startedAt >= since && (!device || r.device === device));
-    return json7({
+    return json8({
       points: runs.map((r) => ({
         at: r.startedAt,
         jobId: r.jobId,
@@ -2484,30 +2545,30 @@ async function scheduleRoutes(req, url) {
     const limit = Number(url.searchParams.get("limit") ?? 50);
     const jobs = jobId ? [jobId] : store3.listJobs().map((j) => j.id);
     const items = jobs.flatMap((id2) => regressionsFor(store3.runs(id2, 500), id2)).sort((a, b) => b.at - a.at).slice(0, limit);
-    return json7({ regressions: items });
+    return json8({ regressions: items });
   }
   const parts = p.slice("/api/schedules/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json7({ error: "not found" }, 404);
+    return json8({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   const verb = parts[1];
   if (!verb && req.method === "DELETE") {
     const job = store3.getJob(id);
     if (!job)
-      return json7({ error: `no schedule '${id}'` }, 404);
+      return json8({ error: `no schedule '${id}'` }, 404);
     const runCount = store3.runs(id, 1e4).length;
     store3.removeJob(id);
     forgetJob(id);
-    return json7({ removed: id, runsDiscarded: runCount });
+    return json8({ removed: id, runsDiscarded: runCount });
   }
   if (verb === "run" && req.method === "POST") {
     const job = store3.getJob(id);
     if (!job)
-      return json7({ error: `no schedule '${id}'` }, 404);
+      return json8({ error: `no schedule '${id}'` }, 404);
     await primeRiskIndex();
     logger.info(`schedule '${id}' run requested from the dashboard`);
     const result = await runJob(job, liveExecutor(), runnerOptions());
-    return json7({
+    return json8({
       ...result,
       job: jobRow(job, store3.runs(id, 500), Date.now())
     });
@@ -2515,17 +2576,17 @@ async function scheduleRoutes(req, url) {
   if (!verb && req.method === "GET") {
     const job = store3.getJob(id);
     if (!job)
-      return json7({ error: `no schedule '${id}'` }, 404);
+      return json8({ error: `no schedule '${id}'` }, 404);
     const runs = store3.runs(id, 500);
-    return json7({ job: jobRow(job, runs, now), runs, regressions: regressionsFor(runs, id) });
+    return json8({ job: jobRow(job, runs, now), runs, regressions: regressionsFor(runs, id) });
   }
-  return json7({ error: "not found" }, 404);
+  return json8({ error: "not found" }, 404);
 }
 
 // src/observability/explain-routes.ts
-var JSON_HEADERS8 = { "content-type": "application/json; charset=utf-8" };
-function json8(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS8 });
+var JSON_HEADERS9 = { "content-type": "application/json; charset=utf-8" };
+function json9(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS9 });
 }
 var storePromise5 = null;
 function snapshots2() {
@@ -2565,53 +2626,53 @@ async function explainRoutes(req, url) {
   if (p === "/api/explain/diff" && req.method === "POST") {
     const body = await req.json().catch(() => null);
     if (!body)
-      return json8({ error: "invalid JSON body" }, 400);
+      return json9({ error: "invalid JSON body" }, 400);
     if (!body.before && !body.beforeText) {
-      return json8({ error: "a diff needs a baseline: pass `before` (a snapshot id) or `beforeText`" }, 400);
+      return json9({ error: "a diff needs a baseline: pass `before` (a snapshot id) or `beforeText`" }, 400);
     }
     const device2 = body.device ?? "";
     const before = body.beforeText ? { text: body.beforeText, device: device2, source: "supplied text" } : await configFor2(device2, body.before ?? null);
     if ("error" in before)
-      return json8({ error: `before: ${before.error}` }, before.status);
+      return json9({ error: `before: ${before.error}` }, before.status);
     const after = body.afterText ? { text: body.afterText, device: device2, source: "supplied text" } : await configFor2(device2, body.after ?? null);
     if ("error" in after)
-      return json8({ error: `after: ${after.error}` }, after.status);
+      return json9({ error: `after: ${after.error}` }, after.status);
     const diff = diffNarratives(analyzeDevice(before.text, before.device), analyzeDevice(after.text, after.device));
-    return json8({ diff, markdown: renderDiff(diff), before: before.source, after: after.source });
+    return json9({ diff, markdown: renderDiff(diff), before: before.source, after: after.source });
   }
   const rest = p.slice("/api/explain/".length).split("/").filter(Boolean);
   if (rest.length === 0)
-    return json8({ error: "not found" }, 404);
+    return json9({ error: "not found" }, 404);
   if (req.method !== "GET")
-    return json8({ error: "not found" }, 404);
+    return json9({ error: "not found" }, 404);
   const device = decodeURIComponent(rest[0]);
   const snapshotId = url.searchParams.get("snapshot");
   let config;
   try {
     config = await configFor2(device, snapshotId);
   } catch (e) {
-    return json8({ error: e instanceof Error ? e.message : String(e) }, 502);
+    return json9({ error: e instanceof Error ? e.message : String(e) }, 502);
   }
   if ("error" in config)
-    return json8({ error: config.error }, config.status);
+    return json9({ error: config.error }, config.status);
   const narrative = { ...analyzeDevice(config.text, config.device), generatedAt: Date.now() };
   if (rest.length === 1) {
-    return json8(payload(narrative, config.source, renderNarrative(narrative)));
+    return json9(payload(narrative, config.source, renderNarrative(narrative)));
   }
   if (rest[1] === "section" && rest[2]) {
     const section = decodeURIComponent(rest[2]);
     if (!NARRATIVE_SECTIONS.includes(section)) {
-      return json8({ error: `unknown section '${section}'. Known: ${NARRATIVE_SECTIONS.join(", ")}` }, 400);
+      return json9({ error: `unknown section '${section}'. Known: ${NARRATIVE_SECTIONS.join(", ")}` }, 400);
     }
-    return json8(payload(narrative, config.source, renderNarrative(narrative, { sections: [section] })));
+    return json9(payload(narrative, config.source, renderNarrative(narrative, { sections: [section] })));
   }
-  return json8({ error: "not found" }, 404);
+  return json9({ error: "not found" }, 404);
 }
 
 // src/observability/attack-routes.ts
-var JSON_HEADERS9 = { "content-type": "application/json; charset=utf-8" };
-function json9(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS9 });
+var JSON_HEADERS10 = { "content-type": "application/json; charset=utf-8" };
+function json10(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS10 });
 }
 async function attackRoutes(req, url) {
   const p = url.pathname;
@@ -2621,7 +2682,7 @@ async function attackRoutes(req, url) {
   try {
     store3 = await attackStore();
   } catch (e) {
-    return json9({ error: e instanceof Error ? e.message : String(e), incidents: [] }, 503);
+    return json10({ error: e instanceof Error ? e.message : String(e), incidents: [] }, 503);
   }
   const cfg = getConfig().attacks;
   const now = Date.now();
@@ -2633,7 +2694,7 @@ async function attackRoutes(req, url) {
     });
     const responses = store3.listResponses({ active: true, limit: 500 });
     const blocked = new Set(responses.map((r) => r.source));
-    return json9({
+    return json10({
       incidents: incidents.map((i) => ({ ...i, blocked: blocked.has(i.source) })),
       responses,
       posture: {
@@ -2673,7 +2734,7 @@ async function attackRoutes(req, url) {
       }
     }
     const active = new Set(store3.listResponses({ active: true, limit: 500 }).map((r) => r.source));
-    return json9({
+    return json10({
       sources: [...bySource.values()].map((s) => ({
         source: s.source,
         devices: [...s.devices].sort(),
@@ -2691,14 +2752,14 @@ async function attackRoutes(req, url) {
     const guards = buildGuards();
     const never = [...neverBlockSet(guards)].sort();
     const check = url.searchParams.get("check");
-    return json9({
+    return json10({
       config: cfg,
       neverBlock: never,
       check: check ? { address: check, protected: isNeverBlock(check, new Set(never)) } : undefined
     });
   }
   if (p === "/api/attacks/config" && req.method === "POST") {
-    return json9({
+    return json10({
       error: "edit the `attacks` block in Config \u2014 the policy has to survive a restart, so it is not held in memory here"
     }, 501);
   }
@@ -2711,7 +2772,7 @@ async function attackRoutes(req, url) {
       onlineOnly: body.onlineOnly,
       respond: false
     });
-    return json9({
+    return json10({
       incidents: result.incidents,
       unavailable: result.unavailable,
       devices: result.devices,
@@ -2719,7 +2780,7 @@ async function attackRoutes(req, url) {
     });
   }
   if (p === "/api/attacks/devices" && req.method === "GET") {
-    return json9({
+    return json10({
       devices: listDevices().names.map((name) => ({
         name,
         reachable: getDeviceStatus(name).reachable
@@ -2732,24 +2793,24 @@ async function attackRoutes(req, url) {
     const response = store3.responseFor(address);
     const devices = response?.devices ?? [];
     if (devices.length === 0)
-      return json9({ error: `no recorded block for ${address}` }, 404);
+      return json10({ error: `no recorded block for ${address}` }, 404);
     const results = await revokeBlock(address, devices, response?.list);
     store3.revokeResponse(address, now);
-    return json9({ address, results });
+    return json10({ address, results });
   }
   if (rest.length === 1 && req.method === "GET") {
     const incident = store3.getIncident(decodeURIComponent(rest[0]));
     if (!incident)
-      return json9({ error: "not found" }, 404);
-    return json9({ incident, response: store3.responseFor(incident.source) });
+      return json10({ error: "not found" }, 404);
+    return json10({ incident, response: store3.responseFor(incident.source) });
   }
   if (rest.length === 2 && rest[1] === "respond" && req.method === "POST") {
     const incident = store3.getIncident(decodeURIComponent(rest[0]));
     if (!incident)
-      return json9({ error: "not found" }, 404);
+      return json10({ error: "not found" }, 404);
     const body = await req.json().catch(() => ({}));
     if (body.action === "dismiss") {
-      return json9({ dismissed: incident.id });
+      return json10({ dismissed: incident.id });
     }
     const decision = decide({
       incident,
@@ -2761,13 +2822,13 @@ async function attackRoutes(req, url) {
       timeout: body.timeout
     });
     if (!isPlan(decision)) {
-      return json9({ refused: true, guard: decision.guard, reason: decision.reason }, 200);
+      return json10({ refused: true, guard: decision.guard, reason: decision.reason }, 200);
     }
     if (decision.action === "escalate") {
-      return json9({ escalated: true, reason: decision.reason });
+      return json10({ escalated: true, reason: decision.reason });
     }
     if (!body.confirm) {
-      return json9({ dryRun: true, plan: decision });
+      return json10({ dryRun: true, plan: decision });
     }
     const applied = await executePlan(decision);
     const ok = applied.some((r) => r.ok);
@@ -2783,15 +2844,15 @@ async function attackRoutes(req, url) {
       ok,
       error: ok ? undefined : applied.map((r) => r.detail).join("; ")
     });
-    return json9({ applied, ok, plan: decision });
+    return json10({ applied, ok, plan: decision });
   }
-  return json9({ error: "not found" }, 404);
+  return json10({ error: "not found" }, 404);
 }
 
 // src/observability/alert-routes.ts
-var JSON_HEADERS10 = { "content-type": "application/json; charset=utf-8" };
-function json10(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS10 });
+var JSON_HEADERS11 = { "content-type": "application/json; charset=utf-8" };
+function json11(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS11 });
 }
 function ruleRow(rule, subject, status, since) {
   return {
@@ -2845,11 +2906,11 @@ async function alertRoutes(req, url, db) {
   const channels = getConfig().alerts?.channels;
   if (p === "/api/alerts" && req.method === "GET") {
     if (!engine) {
-      return json10({ configured: false, rules: [], active: [], channels: {} });
+      return json11({ configured: false, rules: [], active: [], channels: {} });
     }
     const now = Date.now();
     const rows = engine.snapshot().map(({ rule, subject, state }) => ruleRow(rule, subject, isMuted(rule, now) ? "muted" : !rule.enabled ? "disabled" : state.status, state.since));
-    return json10({
+    return json11({
       configured: true,
       rules: rows,
       active: rows.filter((r) => r.status === "firing"),
@@ -2858,41 +2919,41 @@ async function alertRoutes(req, url, db) {
   }
   if (p === "/api/alerts/history" && req.method === "GET") {
     if (!engine)
-      return json10({ history: [] });
+      return json11({ history: [] });
     const hours = Number(url.searchParams.get("hours") ?? 24);
     const history = await engine.history({
       sinceMs: Date.now() - hours * 3600000,
       ruleId: url.searchParams.get("rule") ?? undefined,
       limit: Number(url.searchParams.get("limit") ?? 200)
     });
-    return json10({ history });
+    return json11({ history });
   }
   if (p === "/api/alerts/rules" && req.method === "POST") {
     if (!engine)
-      return json10({ error: "alerting is not configured" }, 400);
+      return json11({ error: "alerting is not configured" }, 400);
     const parsed = AlertRuleSchema.safeParse(await req.json());
     if (!parsed.success) {
-      return json10({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+      return json11({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
     }
     const rules = engine.configuredRules();
     if (rules.some((r) => r.id === parsed.data.id)) {
-      return json10({ error: `rule '${parsed.data.id}' already exists` }, 409);
+      return json11({ error: `rule '${parsed.data.id}' already exists` }, 409);
     }
     engine.setRules([...rules, parsed.data]);
-    return json10({ ok: true, id: parsed.data.id });
+    return json11({ ok: true, id: parsed.data.id });
   }
   const idMatch = p.match(/^\/api\/alerts\/rules\/([^/]+)$/);
   if (idMatch) {
     if (!engine)
-      return json10({ error: "alerting is not configured" }, 400);
+      return json11({ error: "alerting is not configured" }, 400);
     const id = decodeURIComponent(idMatch[1]);
     const rules = engine.configuredRules();
     const existing = rules.find((r) => r.id === id);
     if (!existing)
-      return json10({ error: `unknown rule: ${id}` }, 404);
+      return json11({ error: `unknown rule: ${id}` }, 404);
     if (req.method === "DELETE") {
       engine.setRules(rules.filter((r) => r.id !== id));
-      return json10({ ok: true });
+      return json11({ ok: true });
     }
     if (req.method === "PATCH") {
       const body = await req.json();
@@ -2900,22 +2961,22 @@ async function alertRoutes(req, url, db) {
       if (typeof body.mute === "string") {
         const ms = parseDuration(body.mute);
         if (ms === null)
-          return json10({ error: `invalid duration: ${body.mute}` }, 400);
+          return json11({ error: `invalid duration: ${body.mute}` }, 400);
         mutedUntil = ms === 0 ? undefined : Date.now() + ms;
         delete body.mute;
       }
       const merged = AlertRuleSchema.safeParse({ ...existing, ...body, mutedUntil });
       if (!merged.success) {
-        return json10({ error: merged.error.issues.map((i) => i.message).join("; ") }, 400);
+        return json11({ error: merged.error.issues.map((i) => i.message).join("; ") }, 400);
       }
       engine.setRules(rules.map((r) => r.id === id ? merged.data : r));
-      return json10({ ok: true, rule: merged.data });
+      return json11({ ok: true, rule: merged.data });
     }
   }
   if (p === "/api/alerts/test" && req.method === "POST") {
     const body = await req.json();
     if (!channels || !body?.channel)
-      return json10({ error: "channel is required" }, 400);
+      return json11({ error: "channel is required" }, 400);
     try {
       const result = await deliver(body.channel, channels, {
         ruleId: "test",
@@ -2925,20 +2986,20 @@ async function alertRoutes(req, url, db) {
         body: "If you can read this, this channel is configured correctly.",
         at: Date.now()
       });
-      return json10(result);
+      return json11(result);
     } catch (e) {
       logger.error(`Alert channel test failed: ${logError(e)}`);
-      return json10({ error: clientError(e) }, 502);
+      return json11({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/alerts/preview" && req.method === "POST") {
     const parsed = AlertRuleSchema.safeParse(await req.json());
     if (!parsed.success) {
-      return json10({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+      return json11({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
     }
     const hours = Number(url.searchParams.get("hours") ?? 24);
     if (!db) {
-      return json10({ hours, sampled: 0, fires: 0, resolves: 0, matched: 0, noHistory: true });
+      return json11({ hours, sampled: 0, fires: 0, resolves: 0, matched: 0, noHistory: true });
     }
     const events = db.query({ since: Date.now() - hours * 3600000, limit: 5000 }).map((e) => ({
       ts: e.ts,
@@ -2947,15 +3008,15 @@ async function alertRoutes(req, url, db) {
       risk: e.risk,
       isError: e.isError
     }));
-    return json10({ hours, sampled: events.length, ...previewRule(parsed.data, events) });
+    return json11({ hours, sampled: events.length, ...previewRule(parsed.data, events) });
   }
   return null;
 }
 
 // src/observability/memory-routes.ts
-var JSON_HEADERS11 = { "content-type": "application/json; charset=utf-8" };
-function json11(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS11 });
+var JSON_HEADERS12 = { "content-type": "application/json; charset=utf-8" };
+function json12(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS12 });
 }
 async function bodyJson4(req) {
   return await req.json();
@@ -2966,7 +3027,7 @@ async function memoryRoutes(req, url) {
     return null;
   const cfg = getConfig();
   if (!cfg.memory.enabled) {
-    return json11({ error: "Knowledge-graph memory is disabled" }, 503);
+    return json12({ error: "Knowledge-graph memory is disabled" }, 503);
   }
   if (p === "/api/memory/config" && req.method === "GET") {
     let stats = null;
@@ -2974,7 +3035,7 @@ async function memoryRoutes(req, url) {
       const store4 = await getMemoryStore();
       stats = store4.stats();
     } catch {}
-    return json11({
+    return json12({
       enabled: cfg.memory.enabled,
       dbPath: cfg.memory.dbPath,
       stats
@@ -2988,7 +3049,7 @@ async function memoryRoutes(req, url) {
       try {
         await reopenMemoryStore(body.dbPath);
       } catch (e) {
-        return json11({
+        return json12({
           error: `Failed to open memory DB at ${body.dbPath}: ${e instanceof Error ? e.message : String(e)}`
         }, 400);
       }
@@ -3010,7 +3071,7 @@ async function memoryRoutes(req, url) {
       const store4 = await getMemoryStore();
       stats = store4.stats();
     } catch {}
-    return json11({
+    return json12({
       ok: true,
       enabled: getConfig().memory.enabled,
       dbPath: getConfig().memory.dbPath,
@@ -3019,67 +3080,67 @@ async function memoryRoutes(req, url) {
   }
   const store3 = await getMemoryStore();
   if (p === "/api/memory/graph" && req.method === "GET") {
-    return json11(store3.readGraph());
+    return json12(store3.readGraph());
   }
   if (p === "/api/memory/stats" && req.method === "GET") {
-    return json11(store3.stats());
+    return json12(store3.stats());
   }
   if (p === "/api/memory/search" && req.method === "GET") {
     const q = url.searchParams.get("q") || "";
     const limit = Number(url.searchParams.get("limit") ?? 50);
-    return json11(store3.searchNodes(q, limit));
+    return json12(store3.searchNodes(q, limit));
   }
   if (p === "/api/memory/activity" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 50);
     const since = url.searchParams.get("since");
-    return json11(store3.activity(limit, since ? Number(since) : undefined));
+    return json12(store3.activity(limit, since ? Number(since) : undefined));
   }
   const entityMatch = p.match(/^\/api\/memory\/entity\/(.+)$/);
   if (entityMatch && req.method === "GET") {
     const name = decodeURIComponent(entityMatch[1]);
     const graph = store3.openNodes([name]);
     if (graph.entities.length === 0)
-      return json11({ error: "Entity not found" }, 404);
-    return json11({ entity: graph.entities[0], relations: graph.relations });
+      return json12({ error: "Entity not found" }, 404);
+    return json12({ entity: graph.entities[0], relations: graph.relations });
   }
   if (p === "/api/memory/entities" && req.method === "POST") {
     const body = await bodyJson4(req);
     const created = store3.createEntities(body.entities ?? []);
-    return json11({ created, count: created.length });
+    return json12({ created, count: created.length });
   }
   if (p === "/api/memory/relations" && req.method === "POST") {
     const body = await bodyJson4(req);
     const created = store3.createRelations(body.relations ?? []);
-    return json11({ created, count: created.length });
+    return json12({ created, count: created.length });
   }
   if (p === "/api/memory/observations" && req.method === "POST") {
     const body = await bodyJson4(req);
     const results = store3.addObservations(body.observations ?? []);
-    return json11({ results });
+    return json12({ results });
   }
   if (p === "/api/memory/entities" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store3.deleteEntities(body.names ?? []);
-    return json11({ removed });
+    return json12({ removed });
   }
   if (p === "/api/memory/relations" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store3.deleteRelations(body.relations ?? []);
-    return json11({ removed });
+    return json12({ removed });
   }
   if (p === "/api/memory/observations" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store3.deleteObservations(body.deletions ?? []);
-    return json11({ removed });
+    return json12({ removed });
   }
   return null;
 }
 
 // src/observability/dashboard.ts
 var SERVER_TAG3 = "mikrotik-mcp";
-var JSON_HEADERS12 = { "content-type": "application/json; charset=utf-8" };
-function json12(body, status = 200) {
-  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS12 });
+var JSON_HEADERS13 = { "content-type": "application/json; charset=utf-8" };
+function json13(body, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS13 });
 }
 function restartProcess() {
   let ok = false;
@@ -3379,11 +3440,11 @@ function issues(error) {
 async function configRoutes(req, url, admin) {
   const p = url.pathname;
   if (p === "/api/config-schema" && req.method === "GET") {
-    return json12(configSchemaJson());
+    return json13(configSchemaJson());
   }
   if (p === "/api/config/validate" && req.method === "POST") {
     const merged = mergeSecrets(await readJson(req), getConfig());
-    return json12(validateConfig(merged));
+    return json13(validateConfig(merged));
   }
   if (p === "/api/config/test-device" && req.method === "POST") {
     const body = await readJson(req);
@@ -3392,22 +3453,22 @@ async function configRoutes(req, url, admin) {
     const merged = mergeSecrets(body?.config, currentDc);
     const parsed = DeviceConfigSchema.safeParse(merged);
     if (!parsed.success)
-      return json12({ ok: false, errors: issues(parsed.error) }, 400);
+      return json13({ ok: false, errors: issues(parsed.error) }, 400);
     const status = await probeDevice(`config-test:${name}`, parsed.data);
-    return json12({ ok: true, status });
+    return json13({ ok: true, status });
   }
   if (p === "/api/config/preview" && req.method === "POST") {
     const before = JSON.stringify(redact(getConfig()), null, 2);
     const after = JSON.stringify(await readJson(req) ?? {}, null, 2);
     const d = diffLines(before, after, { fromLabel: "current", toLabel: "edited" });
-    return json12({ summary: d.summary, unified: d.unified });
+    return json13({ summary: d.summary, unified: d.unified });
   }
   if (p === "/api/config" && req.method === "POST") {
     const body = await readJson(req);
     const merged = mergeSecrets(body?.config, getConfig());
     const v = validateConfig(merged);
     if (!v.ok || !v.value)
-      return json12({ ok: false, errors: v.errors }, 400);
+      return json13({ ok: false, errors: v.errors }, 400);
     const prev = getConfig();
     const before = JSON.stringify(redact(prev), null, 2);
     const after = JSON.stringify(redact(v.value), null, 2);
@@ -3416,25 +3477,25 @@ async function configRoutes(req, url, admin) {
     const nextDevs = Object.keys(v.value.devices);
     const devicesChanged = prevDevs.length !== nextDevs.length || prevDevs.some((d) => !nextDevs.includes(d));
     const res = admin.applyConfig(v.value, clampRollback(body?.rollbackMs));
-    return json12({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
+    return json13({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
   }
   if (p === "/api/config/keep" && req.method === "POST") {
     const body = await readJson(req);
     const kept = admin.keepConfig(String(body?.pendingId ?? ""));
     if (kept)
       recordVersion(getConfig(), "auto", Date.now());
-    return json12({ kept });
+    return json13({ kept });
   }
   if (p === "/api/config/rollback" && req.method === "POST") {
     const body = await readJson(req);
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
-    return json12({ rolledBack, config: redact(getConfig()) });
+    return json13({ rolledBack, config: redact(getConfig()) });
   }
   if (p === "/api/reload" && req.method === "POST") {
     const body = await readJson(req);
     if (body?.hard === true) {
       const relaunched = restartProcess();
-      return json12({
+      return json13({
         ok: true,
         mode: "restart",
         note: relaunched ? "Restarting now \u2014 a fresh server process was launched and will bind the same port(s) in ~1.5s. Reconnect shortly." : "Could not self-relaunch; the process is exiting. It only comes back if a supervisor respawns it."
@@ -3445,10 +3506,10 @@ async function configRoutes(req, url, admin) {
       setConfig(cfg);
       const devices = Object.keys(cfg.devices);
       logger.info(`Config reloaded from source \u2014 ${devices.length} device(s): ${devices.join(", ")}`);
-      return json12({ ok: true, mode: "config", count: devices.length, devices });
+      return json13({ ok: true, mode: "config", count: devices.length, devices });
     } catch (e) {
       logger.error(`Config reload failed: ${logError(e)}`);
-      return json12({ ok: false, error: clientError(e) }, 500);
+      return json13({ ok: false, error: clientError(e) }, 500);
     }
   }
   if (p === "/api/config/history" && req.method === "GET") {
@@ -3464,55 +3525,55 @@ async function configRoutes(req, url, admin) {
       } catch {}
       return { ...v, drift: { added, removed } };
     });
-    return json12({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
+    return json13({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
   }
   if (p === "/api/config/history/get" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json12({ error: "id required" }, 400);
+      return json13({ error: "id required" }, 400);
     try {
       const v = readVersion(id);
-      return json12({
+      return json13({
         ts: v.ts,
         kind: v.kind,
         label: v.label,
         config: JSON.stringify(redact(v.config), null, 2)
       });
     } catch {
-      return json12({ error: "not found" }, 404);
+      return json13({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/diff" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json12({ error: "id required" }, 400);
+      return json13({ error: "id required" }, 400);
     try {
       const before = JSON.stringify(redact(readVersion(id).config), null, 2);
       const after = JSON.stringify(redact(getConfig()), null, 2);
       const d = diffLines(before, after, { fromLabel: "this version", toLabel: "current" });
-      return json12({ summary: d.summary, unified: d.unified });
+      return json13({ summary: d.summary, unified: d.unified });
     } catch {
-      return json12({ error: "not found" }, 404);
+      return json13({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/checkpoint" && req.method === "POST") {
     const b = await readJson(req);
     const label = b?.label?.trim() || "checkpoint";
-    return json12({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
+    return json13({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
   }
   if (p === "/api/config/history/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json12({ error: "id required" }, 400);
+      return json13({ error: "id required" }, 400);
     let target;
     try {
       target = readVersion(b.id);
     } catch {
-      return json12({ error: "not found" }, 404);
+      return json13({ error: "not found" }, 404);
     }
     const v = validateConfig(target.config);
     if (!v.ok || !v.value)
-      return json12({ ok: false, errors: v.errors }, 400);
+      return json13({ ok: false, errors: v.errors }, 400);
     recordVersion(getConfig(), "auto", Date.now(), "before restore");
     setConfig(v.value);
     let persisted = true;
@@ -3523,13 +3584,13 @@ async function configRoutes(req, url, admin) {
     }
     const label = target.label ? `restored "${target.label}"` : `restored ${b.id}`;
     recordVersion(getConfig(), "auto", Date.now(), label);
-    return json12({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
+    return json13({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
   }
   if (p === "/api/config/history/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json12({ error: "id required" }, 400);
-    return deleteVersion(b.id) ? json12({ ok: true }) : json12({ error: "not found" }, 404);
+      return json13({ error: "id required" }, 400);
+    return deleteVersion(b.id) ? json13({ ok: true }) : json13({ error: "not found" }, 404);
   }
   return null;
 }
@@ -3540,7 +3601,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules" && req.method === "GET") {
     const cfg = getConfig();
     const src = getConfigSource();
-    return json12({
+    return json13({
       ...moduleSurface(cfg.tools),
       filter: cfg.tools,
       source: src,
@@ -3550,11 +3611,11 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/toggle" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.slug !== "string" || typeof b?.enabled !== "boolean") {
-      return json12({ error: "slug (string) and enabled (boolean) are required" }, 400);
+      return json13({ error: "slug (string) and enabled (boolean) are required" }, 400);
     }
     const mod = moduleCatalog.find((m) => m.slug.toLowerCase() === b.slug.toLowerCase());
     if (!mod)
-      return json12({ error: `unknown module: ${b.slug}` }, 404);
+      return json13({ error: `unknown module: ${b.slug}` }, 404);
     const cfg = getConfig();
     const nextTools = ToolFilterSchema.parse(applyModuleToggle(cfg.tools, mod.slug, b.enabled));
     const next = { ...cfg, tools: nextTools };
@@ -3570,7 +3631,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `module ${b.enabled ? "enabled" : "disabled"}: ${mod.slug}`);
     }
-    return json12({
+    return json13({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -3585,7 +3646,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/app-views" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.enabled !== "boolean") {
-      return json12({ error: "enabled (boolean) is required" }, 400);
+      return json13({ error: "enabled (boolean) is required" }, 400);
     }
     const cfg = getConfig();
     const next = { ...cfg, mcp: { ...cfg.mcp, appViews: b.enabled } };
@@ -3601,7 +3662,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `app views ${b.enabled ? "enabled" : "disabled"}`);
     }
-    return json12({
+    return json13({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -3615,11 +3676,11 @@ async function modulesRoutes(req, url) {
 async function captureRoutes(req, url) {
   const p = url.pathname;
   if (p === "/api/capture/status" && req.method === "GET") {
-    return json12(capture.stats());
+    return json13(capture.stats());
   }
   if (p === "/api/capture/packets" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 200) || 200;
-    return json12({ packets: capture.recent(limit), stats: capture.stats() });
+    return json13({ packets: capture.recent(limit), stats: capture.stats() });
   }
   if (p === "/api/capture/pcap" && req.method === "GET") {
     return new Response(capture.pcap(), {
@@ -3631,11 +3692,11 @@ async function captureRoutes(req, url) {
   }
   if (p === "/api/capture/start" && req.method === "POST") {
     const body = await readJson(req);
-    return json12(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
+    return json13(await capture.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
   }
   if (p === "/api/capture/stop" && req.method === "POST") {
     capture.stop();
-    return json12({ ok: true, ...capture.stats() });
+    return json13({ ok: true, ...capture.stats() });
   }
   return null;
 }
@@ -3647,24 +3708,24 @@ async function capsmanRoutes(req, url) {
   if (req.method === "GET") {
     const ctx = createContext(undefined, url.searchParams.get("device") ?? undefined);
     if (p === "/api/capsman/overview") {
-      return json12(capsmanOverview(await fetchCapsmanState(ctx)));
+      return json13(capsmanOverview(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/clients") {
       const state = await fetchCapsmanState(ctx);
       const weakDbm = Number.parseInt(url.searchParams.get("weak_dbm") ?? "", 10);
       const weak = reportWeakClients(state, Number.isFinite(weakDbm) ? weakDbm : undefined);
-      return json12({ clients: state.clients, weak });
+      return json13({ clients: state.clients, weak });
     }
     if (p === "/api/capsman/audit") {
-      return json12(runCapsmanAudit(await fetchCapsmanState(ctx)));
+      return json13(runCapsmanAudit(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/trends") {
       if (!capsmanStore)
-        return json12({ error: "capsman store not active" }, 503);
+        return json13({ error: "capsman store not active" }, 503);
       const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
       const days = daysParam(url, 7, 30);
       const series = capsmanStore.radioSeries(device, Date.now() - days * 86400000);
-      return json12({ series, days });
+      return json13({ series, days });
     }
     return null;
   }
@@ -3675,45 +3736,45 @@ async function capsmanRoutes(req, url) {
     if (p === "/api/capsman/apply/steer") {
       const client = state.clients.find((c) => c.mac.toLowerCase() === (body.mac ?? "").toLowerCase());
       if (!client)
-        return json12({ ok: false, error: "client not associated" }, 400);
+        return json13({ ok: false, error: "client not associated" }, 400);
       if (steerAlreadyPresent(state, body.mac ?? "")) {
-        return json12({ ok: true, message: "already steered (no-op)" });
+        return json13({ ok: true, message: "already steered (no-op)" });
       }
       const mode = body.mode === "soft" ? "soft" : "hard";
       const commands = buildSteerCommands(state, body.mac ?? "", client.radioId, mode);
       if (!body.confirm)
-        return json12({ ok: true, preview: commands });
-      return json12(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
+        return json13({ ok: true, preview: commands });
+      return json13(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
     }
     if (p === "/api/capsman/apply/load-balance") {
       const plan = loadBalancePlan(state);
       const commands = buildLoadBalanceCommands(state, plan);
       if (!body.confirm)
-        return json12({ ok: true, preview: commands, plan });
-      return json12(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
+        return json13({ ok: true, preview: commands, plan });
+      return json13(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
     }
     if (p === "/api/capsman/apply/channel-plan") {
       if (state.path === "/caps-man") {
-        return json12({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
+        return json13({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
       }
       const commands = buildChannelPlanCommands(state);
       if (!body.confirm)
-        return json12({ ok: true, preview: commands });
-      return json12(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
+        return json13({ ok: true, preview: commands });
+      return json13(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
     }
     if (p === "/api/capsman/apply/ft") {
       const commands = buildFtCommands(state);
       if (!body.confirm)
-        return json12({ ok: true, preview: commands });
-      return json12(await applyCapsmanWrites(ctx, commands, "pre-ft"));
+        return json13({ ok: true, preview: commands });
+      return json13(await applyCapsmanWrites(ctx, commands, "pre-ft"));
     }
     if (p === "/api/capsman/apply/ha") {
       const commands = buildHaCommands(state);
       const guidance = haGuidance(state);
       if (!body.confirm)
-        return json12({ ok: true, preview: commands, guidance });
+        return json13({ ok: true, preview: commands, guidance });
       const res = await applyCapsmanWrites(ctx, commands, "pre-ha");
-      return json12({ ...res, guidance });
+      return json13({ ...res, guidance });
     }
   }
   return null;
@@ -3739,32 +3800,32 @@ async function clientsRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (p === "/api/clients" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json12(devicesView(await fetchDevices(ctx)));
+    return json13(devicesView(await fetchDevices(ctx)));
   }
   if (p === "/api/clients/traffic" && req.method === "GET") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json12({ error: "ip required" }, 400);
+      return json13({ error: "ip required" }, 400);
     const ctx = createContext(undefined, deviceFromQuery());
-    return json12(await sampleDeviceTraffic(ctx, ip));
+    return json13(await sampleDeviceTraffic(ctx, ip));
   }
   if (p === "/api/clients/traffic-bulk" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json12(await sampleAllTraffic(ctx));
+    return json13(await sampleAllTraffic(ctx));
   }
   if (req.method === "POST") {
     const b = await readJson(req);
     const ctx = createContext(undefined, b?.device);
     if (p === "/api/clients/limits") {
       if (!b?.ip)
-        return json12({ error: "ip required" }, 400);
-      return json12(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
+        return json13({ error: "ip required" }, 400);
+      return json13(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
     }
     if (!b?.mac)
-      return json12({ error: "mac required" }, 400);
+      return json13({ error: "mac required" }, 400);
     const run = async (op) => {
       const r = await op;
-      return json12({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
+      return json13({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
     };
     if (p === "/api/clients/block")
       return run(blockDevice(ctx, b.mac, b.comment));
@@ -3776,12 +3837,12 @@ async function clientsRoutes(req, url) {
       return run(removeDeviceLease(ctx, b.mac));
     if (p === "/api/clients/set-ip") {
       if (!b.ip)
-        return json12({ error: "ip required" }, 400);
+        return json13({ error: "ip required" }, 400);
       return run(setDeviceIp(ctx, b.mac, b.ip));
     }
     if (p === "/api/clients/label") {
       if (typeof b.label !== "string")
-        return json12({ error: "label required" }, 400);
+        return json13({ error: "label required" }, 400);
       return run(setDeviceLabel(ctx, b.mac, b.label));
     }
   }
@@ -3794,20 +3855,20 @@ async function aaaRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (req.method === "GET") {
     if (p === "/api/aaa/entities") {
-      return json12({ entities: AAA_ENTITIES });
+      return json13({ entities: AAA_ENTITIES });
     }
     if (p === "/api/aaa/radius-incoming") {
-      return json12(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
+      return json13(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
     }
     if (p === "/api/aaa/um-settings") {
-      return json12(await getUmSettings(createContext(undefined, deviceFromQuery())));
+      return json13(await getUmSettings(createContext(undefined, deviceFromQuery())));
     }
     const listMatch = p.match(/^\/api\/aaa\/list\/([\w-]+)$/);
     if (listMatch) {
       const slug = listMatch[1];
       if (!AAA_ENTITIES[slug])
-        return json12({ error: "unknown entity" }, 404);
-      return json12(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
+        return json13({ error: "unknown entity" }, 404);
+      return json13(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
     }
     return null;
   }
@@ -3815,30 +3876,30 @@ async function aaaRoutes(req, url) {
     const body = await readJson(req);
     const ctx = createContext(undefined, body?.device);
     if (p === "/api/aaa/radius-incoming")
-      return json12(await setRadiusIncoming(ctx, body?.fields ?? {}));
+      return json13(await setRadiusIncoming(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/um-settings")
-      return json12(await setUmSettings(ctx, body?.fields ?? {}));
+      return json13(await setUmSettings(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/radius-reset-counters")
-      return json12(await resetRadiusCounters(ctx));
+      return json13(await resetRadiusCounters(ctx));
     const slug = body?.slug ?? "";
     if (!AAA_ENTITIES[slug])
-      return json12({ error: "unknown entity" }, 404);
+      return json13({ error: "unknown entity" }, 404);
     if (p === "/api/aaa/add")
-      return json12(await addAaaEntity(ctx, slug, body?.fields ?? {}));
+      return json13(await addAaaEntity(ctx, slug, body?.fields ?? {}));
     if (p === "/api/aaa/update") {
       if (!body?.id)
-        return json12({ error: "id required" }, 400);
-      return json12(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
+        return json13({ error: "id required" }, 400);
+      return json13(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
     }
     if (p === "/api/aaa/remove") {
       if (!body?.id)
-        return json12({ error: "id required" }, 400);
-      return json12(await removeAaaEntity(ctx, slug, body.id));
+        return json13({ error: "id required" }, 400);
+      return json13(await removeAaaEntity(ctx, slug, body.id));
     }
     if (p === "/api/aaa/toggle") {
       if (!body?.id)
-        return json12({ error: "id required" }, 400);
-      return json12(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
+        return json13({ error: "id required" }, 400);
+      return json13(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
     }
   }
   return null;
@@ -3854,43 +3915,43 @@ async function usageRoutes(req, url) {
     return null;
   if (p === "/api/usage/sampler") {
     if (req.method === "GET")
-      return json12({ intervalMs: getUsageSamplerInterval() });
+      return json13({ intervalMs: getUsageSamplerInterval() });
     if (req.method === "POST") {
       const b = await readJson(req);
       const applied = setUsageSamplerInterval(Number(b?.intervalMs));
-      return json12({ intervalMs: applied });
+      return json13({ intervalMs: applied });
     }
     return null;
   }
   if (req.method !== "GET")
     return null;
   if (!usageStore)
-    return json12({ error: "usage store not active" }, 503);
+    return json13({ error: "usage store not active" }, 503);
   const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
   const sinceTs = (days) => Date.now() - days * 86400000;
   if (p === "/api/usage/um-users") {
-    return json12({ users: usageStore.umUsers(device) });
+    return json13({ users: usageStore.umUsers(device) });
   }
   if (p === "/api/usage/client") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json12({ error: "ip required" }, 400);
+      return json13({ error: "ip required" }, 400);
     const series = usageStore.clientDailyUsage(device, ip, sinceTs(daysParam(url, 90, 400)));
-    return json12(withTotals(series));
+    return json13(withTotals(series));
   }
   if (p === "/api/usage/um-user") {
     const user = url.searchParams.get("user");
     if (!user)
-      return json12({ error: "user required" }, 400);
+      return json13({ error: "user required" }, 400);
     const series = usageStore.umUserDailyUsage(device, user, sinceTs(daysParam(url, 90, 400)));
-    return json12(withTotals(series));
+    return json13(withTotals(series));
   }
   if (p === "/api/usage/heatmap") {
     const user = url.searchParams.get("user");
     const days = usageStore.heatmap(device, user || null, sinceTs(daysParam(url, 371, 400)));
     const total = days.reduce((s, d) => s + d.count, 0);
     const max = days.reduce((m, d) => Math.max(m, d.count), 0);
-    return json12({ days, total, max });
+    return json13({ days, total, max });
   }
   return null;
 }
@@ -3914,13 +3975,13 @@ async function featureRoutes(req, url) {
     const cfg = getConfig();
     const all = Object.keys(cfg.devices).flatMap((d) => store3.list(d, 200, false));
     all.sort((a, b) => b.ts - a.ts);
-    return json12({ snapshots: all });
+    return json13({ snapshots: all });
   }
   const snapMatch = p.match(/^\/api\/snapshot\/(.+)$/);
   if (snapMatch && req.method === "GET") {
     const store3 = await snapStore();
     const s = store3.get(decodeURIComponent(snapMatch[1]));
-    return s ? json12(s) : json12({ error: "not found" }, 404);
+    return s ? json13(s) : json13({ error: "not found" }, 404);
   }
   if (p === "/api/snapshots/diff" && req.method === "POST") {
     const store3 = await snapStore();
@@ -3928,13 +3989,13 @@ async function featureRoutes(req, url) {
     const from = b?.from ? store3.get(b.from) : null;
     const to = b?.to ? store3.get(b.to) : null;
     if (!from || !to) {
-      return json12({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
+      return json13({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
     }
     const diff = diffLines(normalizeExport(from.body), normalizeExport(to.body), {
       fromLabel: from.label ?? from.id,
       toLabel: to.label ?? to.id
     });
-    return json12({
+    return json13({
       from: { id: from.id, label: from.label, ts: from.ts, device: from.device },
       to: { id: to.id, label: to.label, ts: to.ts, device: to.device },
       summary: diff.summary,
@@ -3948,16 +4009,16 @@ async function featureRoutes(req, url) {
       ...b?.script ? splitCommands(b.script) : []
     ];
     if (commands.length === 0)
-      return json12({ error: "no commands provided" }, 400);
+      return json13({ error: "no commands provided" }, 400);
     const plan = buildChangePlan(commands);
-    return json12({ plan, text: renderPlan(plan) });
+    return json13({ plan, text: renderPlan(plan) });
   }
   if (p === "/api/s3" && req.method === "GET") {
-    return json12({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
+    return json13({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
   }
   if (p === "/api/s3/list" && req.method === "GET") {
     if (!isS3Configured())
-      return json12({ configured: false, objects: [] });
+      return json13({ configured: false, objects: [] });
     const prefix = url.searchParams.get("prefix") ?? "";
     try {
       const res = await getS3Client().list({ prefix: prefix || undefined, maxKeys: 1000 });
@@ -3966,42 +4027,42 @@ async function featureRoutes(req, url) {
         size: o.size ?? 0,
         lastModified: o.lastModified ?? null
       }));
-      return json12({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
+      return json13({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
     } catch (e) {
-      return json12({ error: clientError(e) }, 502);
+      return json13({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/presign" && req.method === "GET") {
     if (!isS3Configured())
-      return json12({ error: "S3 not configured" }, 400);
+      return json13({ error: "S3 not configured" }, 400);
     const key = url.searchParams.get("key");
     if (!key)
-      return json12({ error: "key required" }, 400);
+      return json13({ error: "key required" }, 400);
     try {
       const link = getS3Client().presign(key, { expiresIn: presignExpiresIn(), method: "GET" });
-      return json12({ url: link });
+      return json13({ url: link });
     } catch (e) {
-      return json12({ error: clientError(e) }, 502);
+      return json13({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/delete" && req.method === "POST") {
     if (!isS3Configured())
-      return json12({ error: "S3 not configured" }, 400);
+      return json13({ error: "S3 not configured" }, 400);
     const b = await readJson(req);
     if (!b?.key)
-      return json12({ error: "key required" }, 400);
+      return json13({ error: "key required" }, 400);
     try {
       const client = getS3Client();
       if (!await client.exists(b.key))
-        return json12({ error: "not found" }, 404);
+        return json13({ error: "not found" }, 404);
       await client.delete(b.key);
-      return json12({ ok: true, key: b.key });
+      return json13({ ok: true, key: b.key });
     } catch (e) {
-      return json12({ error: clientError(e) }, 502);
+      return json13({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/backups" && req.method === "GET") {
-    return json12({
+    return json13({
       dir: backupDir(),
       devices: Object.keys(getConfig().devices),
       backups: listBackups()
@@ -4011,14 +4072,14 @@ async function featureRoutes(req, url) {
     const b = await readJson(req);
     const raw = b?.dir?.trim();
     if (!raw)
-      return json12({ error: "dir required" }, 400);
+      return json13({ error: "dir required" }, 400);
     const dir = raw === "~" || raw.startsWith("~/") ? join4(homedir3(), raw.slice(1)) : raw;
     const next = { ...getConfig(), backupDir: dir };
     setConfig(next);
     try {
       atomicWrite(getConfigSource().path, serializeConfig(next));
     } catch (e) {
-      return json12({
+      return json13({
         ok: true,
         dir: backupDir(),
         persisted: false,
@@ -4026,16 +4087,16 @@ async function featureRoutes(req, url) {
       });
     }
     recordVersion(getConfig(), "auto", Date.now(), "backup path changed");
-    return json12({ ok: true, dir: backupDir(), persisted: true });
+    return json13({ ok: true, dir: backupDir(), persisted: true });
   }
   if (p === "/api/backups/get" && req.method === "GET") {
     const name = url.searchParams.get("name");
     if (!name)
-      return json12({ error: "name required" }, 400);
+      return json13({ error: "name required" }, 400);
     try {
-      return json12({ name, content: readBackup(name) });
+      return json13({ name, content: readBackup(name) });
     } catch {
-      return json12({ error: "not found" }, 404);
+      return json13({ error: "not found" }, 404);
     }
   }
   if (p === "/api/backups/raw" && req.method === "GET") {
@@ -4056,41 +4117,41 @@ async function featureRoutes(req, url) {
   if (p === "/api/backups/upload" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || typeof b.content !== "string") {
-      return json12({ error: "name and content are required" }, 400);
+      return json13({ error: "name and content are required" }, 400);
     }
     try {
       const safe = b.name.endsWith(".rsc") ? b.name : `${b.name}.rsc`;
-      return json12({ ok: true, name: writeBackup(safe, b.content) });
+      return json13({ ok: true, name: writeBackup(safe, b.content) });
     } catch (e) {
-      return json12({ error: clientError(e) }, 400);
+      return json13({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/rename" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || !b?.new_name)
-      return json12({ error: "name and new_name are required" }, 400);
+      return json13({ error: "name and new_name are required" }, 400);
     try {
-      return json12({ ok: true, name: renameBackup(b.name, b.new_name) });
+      return json13({ ok: true, name: renameBackup(b.name, b.new_name) });
     } catch (e) {
-      return json12({ error: clientError(e) }, 400);
+      return json13({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json12({ error: "name required" }, 400);
+      return json13({ error: "name required" }, 400);
     try {
-      return deleteBackup(b.name) ? json12({ ok: true }) : json12({ error: "not found" }, 404);
+      return deleteBackup(b.name) ? json13({ ok: true }) : json13({ error: "not found" }, 404);
     } catch (e) {
-      return json12({ error: clientError(e) }, 400);
+      return json13({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json12({ error: "name required" }, 400);
+      return json13({ error: "name required" }, 400);
     const device = resolveDeviceName(b.device);
-    return json12(await restoreLocalBackup(device, b.name, b.confirm === true));
+    return json13(await restoreLocalBackup(device, b.name, b.confirm === true));
   }
   if (p === "/api/backups/create" && req.method === "POST") {
     const b = await readJson(req);
@@ -4102,7 +4163,7 @@ async function featureRoutes(req, url) {
       compact: b?.compact === true,
       terse: b?.terse === true
     });
-    return r.ok ? json12(r) : json12({ error: r.error ?? "export failed" }, 502);
+    return r.ok ? json13(r) : json13({ error: r.error ?? "export failed" }, 502);
   }
   return null;
 }
@@ -4201,6 +4262,9 @@ async function runDashboard(cfg, transportLabel) {
     const driftResp = await driftRoutes(req, url);
     if (driftResp)
       return driftResp;
+    const postureResp = await postureRoutes(req, url);
+    if (postureResp)
+      return postureResp;
     const txnResp = await txnRoutes(req, url);
     if (txnResp)
       return txnResp;
@@ -4233,7 +4297,7 @@ async function runDashboard(cfg, transportLabel) {
       return memoryResp;
     const db = getEventStore();
     if (!db)
-      return json12({ error: "recorder not active" }, 503);
+      return json13({ error: "recorder not active" }, 503);
     if (url.pathname === "/api/events" && req.method === "DELETE") {
       let body = {};
       try {
@@ -4241,7 +4305,7 @@ async function runDashboard(cfg, transportLabel) {
       } catch {}
       const ids = Array.isArray(body.ids) ? body.ids.filter((x) => typeof x === "string") : [];
       const removed = body.all === true ? db.clear() : db.delete(ids);
-      return json12({ removed, total: db.total() });
+      return json13({ removed, total: db.total() });
     }
     if (url.pathname === "/api/ssh-pool") {
       const cfg2 = getConfig();
@@ -4250,7 +4314,7 @@ async function runDashboard(cfg, transportLabel) {
       const totalInflight = ps.reduce((s, p) => s + p.inflight, 0);
       const totalIdle = ps.filter((p) => p.idle).length;
       const totalBusy = ps.filter((p) => p.inflight > 0).length;
-      return json12({
+      return json13({
         enabled,
         config: {
           keepAlive: cfg2.ssh.keepAlive,
@@ -4279,39 +4343,39 @@ async function runDashboard(cfg, transportLabel) {
       });
     }
     if (url.pathname === "/api/devices") {
-      return json12(devicesPayload(db));
+      return json13(devicesPayload(db));
     }
     if (url.pathname === "/api/capabilities") {
       const devices = Object.keys(getConfig().devices).map((name) => ({
         device: name,
         capabilities: serializeCapabilities(peekCapabilities(name))
       }));
-      return json12({ devices });
+      return json13({ devices });
     }
     if (url.pathname === "/api/capabilities/refresh" && req.method === "POST") {
       const b = await readJson(req);
       if (typeof b?.device !== "string")
-        return json12({ error: "device (string) is required" }, 400);
+        return json13({ error: "device (string) is required" }, 400);
       if (!(b.device in getConfig().devices)) {
-        return json12({ error: `unknown device: ${b.device}` }, 404);
+        return json13({ error: `unknown device: ${b.device}` }, 404);
       }
       invalidateCapabilities(b.device);
       try {
         const caps = await getCapabilities(b.device);
-        return json12({ device: b.device, capabilities: serializeCapabilities(caps) });
+        return json13({ device: b.device, capabilities: serializeCapabilities(caps) });
       } catch (e) {
         logger.error(`Capability probe failed for '${b.device}': ${logError(e)}`);
-        return json12({ error: clientError(e) }, 502);
+        return json13({ error: clientError(e) }, 502);
       }
     }
     if (url.pathname === "/api/devices/toggle" && req.method === "POST") {
       const b = await readJson(req);
       if (typeof b?.device !== "string" || typeof b?.disabled !== "boolean") {
-        return json12({ error: "device (string) and disabled (boolean) are required" }, 400);
+        return json13({ error: "device (string) and disabled (boolean) are required" }, 400);
       }
       const cfg2 = getConfig();
       if (!(b.device in cfg2.devices))
-        return json12({ error: `unknown device: ${b.device}` }, 404);
+        return json13({ error: `unknown device: ${b.device}` }, 404);
       const dc = cfg2.devices[b.device];
       const next = {
         ...cfg2,
@@ -4332,7 +4396,7 @@ async function runDashboard(cfg, transportLabel) {
       if (persisted) {
         recordVersion(getConfig(), "auto", Date.now(), `device ${b.disabled ? "disabled" : "enabled"}: ${b.device}`);
       }
-      return json12({
+      return json13({
         ok: true,
         persisted,
         requiresReconnect: true,
@@ -4345,17 +4409,17 @@ async function runDashboard(cfg, transportLabel) {
       const name = typeof b?.device === "string" ? b.device : "";
       const cfg2 = getConfig();
       if (!(name in cfg2.devices))
-        return json12({ error: `unknown device: ${name}` }, 404);
+        return json13({ error: `unknown device: ${name}` }, 404);
       if (url.pathname === "/api/devices/reconnect")
         closeDevice(name);
       const status = await probeDevice(name, cfg2.devices[name]);
-      return json12({ ok: true, status, ...devicesPayload(db) });
+      return json13({ ok: true, status, ...devicesPayload(db) });
     }
     if (url.pathname === "/api/topology") {
-      return json12(topologyPayload());
+      return json13(topologyPayload());
     }
     if (url.pathname === "/api/config") {
-      return json12(configPayload());
+      return json13(configPayload());
     }
     if (url.pathname === "/" || url.pathname === "/index.html") {
       return new Response(dashboardHtml(), {
@@ -4364,9 +4428,9 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases/latest") {
       try {
-        return json12(await fetchLatestRelease());
+        return json13(await fetchLatestRelease());
       } catch (e) {
-        return json12({ error: clientError(e, "fetch failed") }, 502);
+        return json13({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/catalog" && req.method === "GET") {
@@ -4385,7 +4449,7 @@ async function runDashboard(cfg, transportLabel) {
       }));
       const prompts = listPrompts();
       const groups = [...new Set(modules.map((m) => m.group))].sort();
-      return json12({
+      return json13({
         modules,
         prompts,
         groups,
@@ -4400,25 +4464,25 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases" && req.method === "GET") {
       try {
-        return json12(await fetchAllReleases());
+        return json13(await fetchAllReleases());
       } catch (e) {
-        return json12({ error: clientError(e, "fetch failed") }, 502);
+        return json13({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/upgrade" && req.method === "POST") {
       const body = await readJson(req);
       const version = String(body?.version ?? "latest");
       if (version !== "latest" && !/^\d+\.\d+\.\d+$/.test(version)) {
-        return json12({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
+        return json13({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
       }
       const spec = `@usex/mikrotik-mcp@${version}`;
       logger.warn(`Dashboard requested upgrade: bun i -g ${spec}`);
       const { ok, log } = await runUpgrade(spec);
       if (!ok)
-        return json12({ ok: false, version, log }, 500);
+        return json13({ ok: false, version, log }, 500);
       const willRestart = body?.restart !== false;
       const relaunched = willRestart ? restartProcess() : false;
-      return json12({
+      return json13({
         ok: true,
         version,
         log,
@@ -4428,7 +4492,7 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/meta") {
       const f = facets(db);
-      return json12({
+      return json13({
         ...f,
         version: VERSION,
         risks: ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"],
@@ -4439,19 +4503,19 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/events") {
       const filter = filterFromQuery(url);
-      return json12({ events: db.query(filter), total: db.total() });
+      return json13({ events: db.query(filter), total: db.total() });
     }
     const eventMatch = url.pathname.match(/^\/api\/event\/(.+)$/);
     if (eventMatch) {
       const e = db.get(decodeURIComponent(eventMatch[1]));
-      return e ? json12(e) : json12({ error: "not found" }, 404);
+      return e ? json13(e) : json13({ error: "not found" }, 404);
     }
     if (url.pathname === "/api/stats") {
       const now = Date.now();
       const windowMs2 = Number(url.searchParams.get("window") ?? 3600000);
       const buckets = Number(url.searchParams.get("buckets") ?? 60);
       const events = db.query({ since: now - windowMs2, limit: 5000 });
-      return json12(computeStats(events, { now, windowMs: windowMs2, buckets }));
+      return json13(computeStats(events, { now, windowMs: windowMs2, buckets }));
     }
     return new Response("Not Found", { status: 404 });
   }
@@ -4470,7 +4534,7 @@ async function runDashboard(cfg, transportLabel) {
         return await dashboardRoute(req, url, srv, configAdmin, transportLabel);
       } catch (e) {
         logger.error(`Dashboard request failed (${url.pathname}): ${logError(e)}`);
-        return json12({ error: clientError(e) }, 502);
+        return json13({ error: clientError(e) }, 502);
       }
     },
     websocket: {