@usex/mikrotik-mcp 5.8.0 → 5.9.0

package/dist/cli.js

@@ -17672,6 +17672,12 @@ function toolUiMeta(ui) {
   return meta;
 }
 
+// src/core/tool-pattern.ts
+function globMatch(pattern, name) {
+  const rx = new RegExp(`^${pattern.toLowerCase().replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
+  return rx.test(name.toLowerCase());
+}
+
 // src/core/access.ts
 var RISK_ORDER = [
   "READ",
@@ -17687,10 +17693,6 @@ var RISK_RANK = {
   DESTRUCTIVE: 2,
   DANGEROUS: 3
 };
-function globMatch(pattern, name) {
-  const rx = new RegExp(`^${pattern.toLowerCase().replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
-  return rx.test(name.toLowerCase());
-}
 function matchesAny(patterns, name) {
   return (patterns ?? []).some((p) => globMatch(p, name));
 }
@@ -17720,7 +17722,20 @@ function evaluateAccess(policy, req) {
       reason: `Tool '${req.tool}' is outside the active access scope${where}. ` + `Allowed: ${s.tools.join(", ")}.`
     };
   }
+  if ((s.toolAllowGroups ?? []).some((group) => !matchesAny(group, req.tool))) {
+    return {
+      allowed: false,
+      rule: "tool",
+      reason: `Tool '${req.tool}' does not satisfy every configured and session tool allow-list${where}.`
+    };
+  }
   if (req.device !== undefined) {
+    if (s.noDevices)
+      return {
+        allowed: false,
+        rule: "device",
+        reason: `No devices remain in the intersection of the configured and session access scopes${where}.`
+      };
     if ((s.denyDevices ?? []).some((d) => d.toLowerCase() === req.device.toLowerCase())) {
       return {
         allowed: false,
@@ -17759,7 +17774,14 @@ function narrowScope(base, requested) {
     return b.filter((x) => lower.has(x.toLowerCase()));
   };
   out.devices = intersect(base.devices, requested.devices);
+  if (base.noDevices || requested.noDevices || base.devices?.length && requested.devices?.length && !out.devices?.length)
+    out.noDevices = true;
   out.tools = requested.tools && requested.tools.length > 0 ? requested.tools : base.tools;
+  const groups = [...base.toolAllowGroups ?? [], ...requested.toolAllowGroups ?? []];
+  if (base.tools?.length && requested.tools?.length)
+    groups.push(base.tools);
+  if (groups.length)
+    out.toolAllowGroups = [...new Map(groups.map((g) => [JSON.stringify(g), g])).values()];
   out.denyDevices = [...new Set([...base.denyDevices ?? [], ...requested.denyDevices ?? []])];
   out.denyTools = [...new Set([...base.denyTools ?? [], ...requested.denyTools ?? []])];
   if (out.denyDevices.length === 0)
@@ -17794,14 +17816,20 @@ function adoptConfiguredPolicy() {
 }
 onConfigChanged(adoptConfiguredPolicy);
 adoptConfiguredPolicy();
-function getAccessPolicy() {
+function previewAccessPolicy(policy) {
   if (!sessionNarrowing)
-    return basePolicy;
+    return policy;
   return {
     enabled: true,
-    scope: narrowScope(basePolicy.scope, sessionNarrowing)
+    scope: narrowScope(policy.scope, sessionNarrowing)
   };
 }
+function getAccessPolicy() {
+  return previewAccessPolicy(basePolicy);
+}
+function hasSessionNarrowing() {
+  return sessionNarrowing !== undefined;
+}
 function narrowSession(requested) {
   sessionNarrowing = sessionNarrowing ? narrowScope(sessionNarrowing, requested) : narrowScope(basePolicy.scope, requested);
   return getAccessPolicy().scope;
@@ -19470,6 +19498,7 @@ function defineTool(def) {
     description: def.description,
     annotations: def.annotations,
     inputSchema: def.inputSchema,
+    noDevice: def.noDevice,
     ui: def.ui,
     requires: def.requires,
     handler: def.handler,
@@ -30039,7 +30068,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./shared/cli-ejryxvb3.js");
+  const { moduleCatalog } = await import("./shared/cli-2a9bs005.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -41454,7 +41483,7 @@ ${DATASET_NOTE}`;
 function renderScope(scope) {
   const lines = [];
   lines.push(`  max risk    : ${scope.maxRisk ?? "(no ceiling)"}`);
-  lines.push(`  devices     : ${scope.devices && scope.devices.length > 0 ? scope.devices.join(", ") : "(all configured)"}`);
+  lines.push(`  devices     : ${scope.noDevices ? "(none: scopes do not overlap)" : scope.devices && scope.devices.length > 0 ? scope.devices.join(", ") : "(all configured)"}`);
   if (scope.denyDevices && scope.denyDevices.length > 0) {
     lines.push(`  denied devs : ${scope.denyDevices.join(", ")}`);
   }
@@ -41462,6 +41491,8 @@ function renderScope(scope) {
   if (scope.denyTools && scope.denyTools.length > 0) {
     lines.push(`  denied tools: ${scope.denyTools.join(", ")}`);
   }
+  for (const group of scope.toolAllowGroups ?? [])
+    lines.push(`  also match  : ${group.join(", ")}`);
   lines.push(`  expires     : ${scope.expiresAt ? new Date(scope.expiresAt).toISOString() : "(never)"}`);
   if (scope.label)
     lines.push(`  label       : ${scope.label}`);
@@ -52263,7 +52294,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./shared/cli-ejryxvb3.js");
+  const { moduleCatalog } = await import("./shared/cli-2a9bs005.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)
@@ -64129,9 +64160,170 @@ async function postureRoutes(req, url) {
   return null;
 }
 
+// src/observability/access-settings.ts
+import { createHash as createHash4 } from "crypto";
+var list2 = array(string2().trim().min(1).max(200)).max(200);
+var accessSchema = AccessConfigSchema.extend({
+  devices: list2,
+  denyDevices: list2,
+  tools: list2,
+  denyTools: list2,
+  label: string2().trim().max(200).optional()
+}).strict();
+var editSchema = object({
+  revision: string2().min(1),
+  access: accessSchema,
+  device: string2().optional(),
+  tool: string2().optional()
+}).strict();
+var idSchema = object({ pendingId: string2().min(1) }).strict();
+var json4 = (body, status = 200) => Response.json(body, { status });
+var policyFor = ({ enabled, ...scope }) => ({ enabled, scope });
+function createAccessSettingsRoutes(admin, deps = {
+  getConfig,
+  getConfigSource,
+  getAccessPolicy,
+  hasSessionNarrowing,
+  previewAccessPolicy,
+  recentDenials,
+  recordVersion,
+  now: Date.now
+}) {
+  let pending = null;
+  const tools = moduleCatalog2.flatMap((m) => m.tools.map((t) => ({ name: t.name, risk: riskOf(t.annotations), noDevice: !!t.noDevice })));
+  const revision = () => createHash4("sha256").update(JSON.stringify([deps.getConfig(), deps.getAccessPolicy()])).digest("hex");
+  const payload = () => {
+    const cfg = deps.getConfig();
+    const id = admin.pendingId();
+    return {
+      revision: revision(),
+      configured: cfg.access,
+      effective: deps.getAccessPolicy(),
+      narrowed: deps.hasSessionNarrowing(),
+      readOnly: cfg.readOnly,
+      devices: Object.entries(cfg.devices).map(([name, d]) => ({ name, disabled: !!d.disabled })),
+      tools,
+      denials: deps.recentDenials(50),
+      fromFile: deps.getConfigSource().fromFile,
+      pending: id ? {
+        id,
+        owned: id === pending?.id,
+        expiresAt: id === pending?.id ? pending.expiresAt : undefined
+      } : null
+    };
+  };
+  return async (req, url) => {
+    const path = url.pathname;
+    if (!path.startsWith("/api/access/settings"))
+      return null;
+    if (path === "/api/access/settings" && req.method === "GET")
+      return json4(payload());
+    if (!["preview", "apply", "keep", "rollback"].some((s) => path === `/api/access/settings/${s}`))
+      return json4({ error: "Not found" }, 404);
+    if (req.method !== "POST")
+      return json4({ error: "Use POST" }, 405);
+    if (req.headers.get("sec-fetch-site") === "cross-site")
+      return json4({ error: "Cross-site access changes are not allowed" }, 403);
+    if (req.headers.get("content-type")?.split(";")[0].trim() !== "application/json")
+      return json4({ error: "Expected application/json" }, 415);
+    let body;
+    try {
+      const text = await req.text();
+      if (text.length > 65536)
+        return json4({ error: "Access settings are too large" }, 413);
+      body = JSON.parse(text);
+    } catch {
+      return json4({ error: "Invalid JSON" }, 400);
+    }
+    if (path.endsWith("/keep") || path.endsWith("/rollback")) {
+      const parsed = idSchema.safeParse(body);
+      if (!parsed.success)
+        return json4({ error: "A pending change ID is required" }, 400);
+      const id = parsed.data.pendingId;
+      if (pending?.id !== id || admin.pendingId() !== id)
+        return json4({ error: "This change expired or was replaced. Refresh the current policy." }, 409);
+      const keep = path.endsWith("/keep");
+      const ok = keep ? admin.keepConfig(id) : admin.rollback(id);
+      if (!ok)
+        return json4({ error: "This change is no longer pending" }, 409);
+      pending = null;
+      if (keep)
+        deps.recordVersion(deps.getConfig(), "auto", deps.now(), "access scope updated");
+      return json4({ ok: true, settings: payload() });
+    }
+    const parsed = editSchema.safeParse(body);
+    if (!parsed.success)
+      return json4({ error: parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ") }, 400);
+    const { access, tool } = parsed.data;
+    if (parsed.data.revision !== revision())
+      return json4({ error: "Configuration changed since you opened this editor. Refresh before applying." }, 409);
+    const cfg = deps.getConfig();
+    const device = parsed.data.device ? Object.keys(cfg.devices).find((key) => key.toLowerCase() === parsed.data.device.toLowerCase()) : cfg.defaultDevice;
+    const unknownDevice = [
+      ...access.devices,
+      ...access.denyDevices,
+      ...parsed.data.device ? [parsed.data.device] : []
+    ].find((name) => !Object.keys(cfg.devices).some((key) => key.toLowerCase() === name.toLowerCase()));
+    if (unknownDevice)
+      return json4({ error: `Unknown device: ${unknownDevice}` }, 400);
+    if (tool && !tools.some((t) => t.name === tool))
+      return json4({ error: `Unknown tool: ${tool}` }, 400);
+    if (path.endsWith("/preview")) {
+      const effective = deps.previewAccessPolicy(policyFor(access));
+      const current = deps.getAccessPolicy();
+      const now = deps.now();
+      const decide = (policy, t) => {
+        if (cfg.readOnly && t.risk !== "READ")
+          return { allowed: false, reason: "Server-wide read-only mode prevents writes." };
+        if (!t.noDevice && (!device || !cfg.devices[device]))
+          return {
+            allowed: false,
+            rule: "device",
+            reason: "No configured target router is available."
+          };
+        if (!t.noDevice && device && cfg.devices[device]?.disabled)
+          return { allowed: false, rule: "device", reason: "This configured device is disabled." };
+        return evaluateAccess(policy, {
+          tool: t.name,
+          risk: t.risk,
+          device: t.noDevice ? undefined : device,
+          now
+        });
+      };
+      const result = {
+        effective,
+        allowed: 0,
+        blocked: 0,
+        newlyAllowed: 0,
+        newlyBlocked: 0,
+        device
+      };
+      for (const t of tools) {
+        const next = decide(effective, t);
+        const prev = decide(current, t);
+        result[next.allowed ? "allowed" : "blocked"]++;
+        if (next.allowed && !prev.allowed)
+          result.newlyAllowed++;
+        if (!next.allowed && prev.allowed)
+          result.newlyBlocked++;
+        if (tool === t.name)
+          result.check = next;
+      }
+      return json4({ ok: true, preview: result });
+    }
+    if (admin.pendingId())
+      return json4({
+        error: "Another configuration change is awaiting confirmation. Keep or revert it first."
+      }, 409);
+    const res = admin.applyConfig({ ...cfg, access }, 60000);
+    pending = { id: res.pendingId, expiresAt: deps.now() + res.rollbackMs };
+    return json4({ ok: true, settings: payload() });
+  };
+}
+
 // src/observability/txn-routes.ts
 var JSON_HEADERS3 = { "content-type": "application/json; charset=utf-8" };
-function json4(body, status = 200) {
+function json5(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS3 });
 }
 function liveRecord(id) {
@@ -64158,16 +64350,16 @@ async function txnRoutes(req, url) {
     for (const r of live)
       byId.set(r.id, r);
     const transactions = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
-    return json4({ transactions, live: liveTxnUpdates(), error: storeError });
+    return json5({ transactions, live: liveTxnUpdates(), error: storeError });
   }
   const parts = p.slice("/api/txn/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json4({ error: "not found" }, 404);
+    return json5({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   if (parts[1] === "abort" && req.method === "POST") {
     const entry = getTxn(id);
     if (!entry)
-      return json4({ error: `no open transaction '${id}'` }, 404);
+      return json5({ error: `no open transaction '${id}'` }, 404);
     entry.txn = requestAbort(entry.txn, "aborted from the dashboard");
     const run = await runTransaction({
       txn: entry.txn,
@@ -64178,7 +64370,7 @@ async function txnRoutes(req, url) {
     await persistTxn(entry);
     if (run.state !== undefined)
       dropTxn(id);
-    return json4({
+    return json5({
       state: run.state,
       summary: run.summary,
       transaction: toRecord2(run.txn, entry.ts)
@@ -64187,15 +64379,15 @@ async function txnRoutes(req, url) {
   if (parts.length === 1 && req.method === "GET") {
     const record = liveRecord(id) ?? store?.get(id) ?? null;
     if (!record)
-      return json4({ error: `unknown transaction '${id}'` }, 404);
-    return json4({ transaction: record, events: store?.events(id) ?? [] });
+      return json5({ error: `unknown transaction '${id}'` }, 404);
+    return json5({ transaction: record, events: store?.events(id) ?? [] });
   }
-  return json4({ error: "method not allowed" }, 405);
+  return json5({ error: "method not allowed" }, 405);
 }
 
 // src/observability/flow-routes.ts
 var JSON_HEADERS4 = { "content-type": "application/json; charset=utf-8" };
-function json5(body, status = 200) {
+function json6(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS4 });
 }
 var WINDOWS2 = {
@@ -64216,14 +64408,14 @@ async function flowRoutes(req, url) {
   if (!p.startsWith("/api/flows"))
     return null;
   if (req.method !== "GET")
-    return json5({ error: "method not allowed" }, 405);
+    return json6({ error: "method not allowed" }, 405);
   const collector = getFlowCollector();
   if (p === "/api/flows/health") {
     let store = null;
     try {
       store = (await flowStore()).stats();
     } catch {}
-    return json5({ collector: collector.stats(), store });
+    return json6({ collector: collector.stats(), store });
   }
   collector.drain();
   let records;
@@ -64234,12 +64426,12 @@ async function flowRoutes(req, url) {
   try {
     records = (await flowStore()).query({ from, to, address, limit: 200000 });
   } catch (e) {
-    return json5({ error: e instanceof Error ? e.message : String(e), records: [] }, 200);
+    return json6({ error: e instanceof Error ? e.message : String(e), records: [] }, 200);
   }
   if (p === "/api/flows/top") {
     const dimension = url.searchParams.get("dimension") ?? "source";
     const limit = Number(url.searchParams.get("limit") ?? 10);
-    return json5({
+    return json6({
       window: { from, to },
       totals: summarize2(records),
       top: topTalkers(records, dimension, limit, true),
@@ -64249,7 +64441,7 @@ async function flowRoutes(req, url) {
   }
   if (p === "/api/flows/conversations") {
     const limit = Number(url.searchParams.get("limit") ?? 20);
-    return json5({
+    return json6({
       window: { from, to },
       conversations: conversations(records, limit)
     });
@@ -64258,19 +64450,19 @@ async function flowRoutes(req, url) {
     const dimension = url.searchParams.get("dimension") ?? "source";
     const topN = Number(url.searchParams.get("topN") ?? 5);
     const bucket = bucketFor2(span);
-    return json5({
+    return json6({
       window: { from, to },
       bucketMs: bucket,
       keys: topTalkers(records, dimension, topN).map((t) => t.key),
       buckets: timeline(records, from, to, bucket, dimension, topN)
     });
   }
-  return json5({ error: "not found" }, 404);
+  return json6({ error: "not found" }, 404);
 }
 
 // src/observability/rollout-routes.ts
 var JSON_HEADERS5 = { "content-type": "application/json; charset=utf-8" };
-function json6(body, status = 200) {
+function json7(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS5 });
 }
 function liveRecord2(id) {
@@ -64300,17 +64492,17 @@ async function rolloutRoutes(req, url) {
     for (const r of live)
       byId.set(r.id, r);
     const rollouts = [...byId.values()].sort((a, b) => b.ts - a.ts).slice(0, limit);
-    return json6({ rollouts, live: liveRolloutUpdates(), error: storeError });
+    return json7({ rollouts, live: liveRolloutUpdates(), error: storeError });
   }
   const parts = p.slice("/api/rollout/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json6({ error: "not found" }, 404);
+    return json7({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   const verb = parts[1];
   if (verb && req.method === "POST") {
     const entry = getRollout(id);
     if (!entry)
-      return json6({ error: `no active rollout '${id}'` }, 404);
+      return json7({ error: `no active rollout '${id}'` }, 404);
     switch (verb) {
       case "hold": {
         entry.state = requestHold(entry.state);
@@ -64325,7 +64517,7 @@ async function rolloutRoutes(req, url) {
           devices: entry.state.devices,
           gates: entry.state.gates
         });
-        return json6({ held: true, summary: summarize5(entry.state) });
+        return json7({ held: true, summary: summarize5(entry.state) });
       }
       case "resume": {
         entry.state = resume(entry.state);
@@ -64353,7 +64545,7 @@ async function rolloutRoutes(req, url) {
         await persistRollout(entry);
         if (run.outcome)
           dropRollout(id);
-        return json6({ outcome: run.outcome, summary: run.summary });
+        return json7({ outcome: run.outcome, summary: run.summary });
       }
       case "abort": {
         entry.state = requestAbort2(entry.state, "aborted from the dashboard");
@@ -64366,19 +64558,19 @@ async function rolloutRoutes(req, url) {
         await persistRollout(entry);
         if (run.outcome)
           dropRollout(id);
-        return json6({ outcome: run.outcome, summary: run.summary });
+        return json7({ outcome: run.outcome, summary: run.summary });
       }
       default:
-        return json6({ error: `unknown action '${verb}'` }, 404);
+        return json7({ error: `unknown action '${verb}'` }, 404);
     }
   }
   if (parts.length === 1 && req.method === "GET") {
     const record = liveRecord2(id) ?? store?.get(id) ?? null;
     if (!record)
-      return json6({ error: `unknown rollout '${id}'` }, 404);
-    return json6({ rollout: record, events: store?.events(id) ?? [] });
+      return json7({ error: `unknown rollout '${id}'` }, 404);
+    return json7({ rollout: record, events: store?.events(id) ?? [] });
   }
-  return json6({ error: "method not allowed" }, 405);
+  return json7({ error: "method not allowed" }, 405);
 }
 
 // src/policy/results.ts
@@ -64468,7 +64660,7 @@ async function policyResults(device, limit = 50) {
 
 // src/observability/policy-routes.ts
 var JSON_HEADERS6 = { "content-type": "application/json; charset=utf-8" };
-function json7(body, status = 200) {
+function json8(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS6 });
 }
 async function bodyJson2(req) {
@@ -64480,7 +64672,7 @@ async function policyRoutes(req, url) {
     return null;
   if (p === "/api/policies" && req.method === "GET") {
     const set = currentPolicySet();
-    return json7({
+    return json8({
       files: set.files.map((f) => ({
         path: f.path,
         name: f.name,
@@ -64501,21 +64693,21 @@ async function policyRoutes(req, url) {
     try {
       results = await policyResults(device, limit);
     } catch (e) {
-      return json7({ results: [], error: e instanceof Error ? e.message : String(e) });
+      return json8({ results: [], error: e instanceof Error ? e.message : String(e) });
     }
-    return json7({ results });
+    return json8({ results });
   }
   if (p === "/api/policies/validate" && req.method === "POST") {
     const body = await bodyJson2(req);
     if (typeof body.content !== "string")
-      return json7({ error: "content is required" }, 400);
-    return json7(validatePolicyText(body.content));
+      return json8({ error: "content is required" }, 400);
+    return json8(validatePolicyText(body.content));
   }
   if (p === "/api/policies/run" && req.method === "POST") {
     const body = await bodyJson2(req);
     const set = currentPolicySet();
     if (set.policies.length === 0) {
-      return json7({ error: "no policy rules are loaded", reports: [] });
+      return json8({ error: "no policy rules are loaded", reports: [] });
     }
     const cfg = getConfig();
     const devices = body.devices && body.devices.length > 0 ? body.devices : Object.entries(cfg.devices).filter(([, d]) => !d.disabled).map(([name]) => name);
@@ -64544,14 +64736,14 @@ async function policyRoutes(req, url) {
         reports.push({ device, error: e instanceof Error ? e.message : String(e) });
       }
     }
-    return json7({ reports });
+    return json8({ reports });
   }
-  return json7({ error: "not found" }, 404);
+  return json8({ error: "not found" }, 404);
 }
 
 // src/observability/sim-routes.ts
 var JSON_HEADERS7 = { "content-type": "application/json; charset=utf-8" };
-function json8(body, status = 200) {
+function json9(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS7 });
 }
 async function bodyJson3(req) {
@@ -64584,28 +64776,28 @@ async function simRoutes(req, url) {
   if (!p.startsWith("/api/sim"))
     return null;
   if (p === "/api/sim/suites" && req.method === "GET") {
-    return json8({ suites: await listSuites() });
+    return json9({ suites: await listSuites() });
   }
   if (p === "/api/sim/suites" && req.method === "POST") {
     const body = await bodyJson3(req);
     if (!body.name || !Array.isArray(body.packets) || body.packets.length === 0) {
-      return json8({ error: "name and a non-empty packets array are required" }, 400);
+      return json9({ error: "name and a non-empty packets array are required" }, 400);
     }
     const saved = await saveSuite({
       id: body.id,
       name: body.name,
       packets: body.packets
     });
-    return json8({ suite: saved });
+    return json9({ suite: saved });
   }
   if (p === "/api/sim/packet" && req.method === "POST") {
     const body = await bodyJson3(req);
     const config = await configFor(body);
     if ("error" in config)
-      return json8(config, 400);
+      return json9(config, 400);
     const model = buildModel(config.text);
     const result = tracePacket({ model, packet: body.packet });
-    return json8({
+    return json9({
       source: config.source,
       result,
       coverage: {
@@ -64619,16 +64811,16 @@ async function simRoutes(req, url) {
     const body = await bodyJson3(req);
     const config = await configFor(body);
     if ("error" in config)
-      return json8(config, 400);
+      return json9(config, 400);
     if (!body.changes || body.changes.trim() === "") {
-      return json8({ error: "changes are required" }, 400);
+      return json9({ error: "changes are required" }, 400);
     }
     const before = tracePacket({ model: buildModel(config.text), packet: body.packet });
     const afterModel = buildModel(`${config.text}
 ${body.changes}
 `);
     const after = tracePacket({ model: afterModel, packet: body.packet });
-    return json8({
+    return json9({
       source: config.source,
       before,
       after,
@@ -64643,10 +64835,10 @@ ${body.changes}
       packet: {}
     });
     if ("error" in config)
-      return json8(config, 400);
+      return json9(config, 400);
     const model = buildModel(config.text);
     const dead = unreachableRules(model.filter);
-    return json8({
+    return json9({
       source: config.source,
       rules: model.filter.map((r) => ({
         chain: r.chain,
@@ -64667,11 +64859,11 @@ ${body.changes}
     const id = decodeURIComponent(p.slice("/api/sim/suite/".length, -"/run".length));
     const suite = await getSuite(id);
     if (!suite)
-      return json8({ error: `no suite '${id}'` }, 404);
+      return json9({ error: `no suite '${id}'` }, 404);
     const body = await bodyJson3(req);
     const config = await configFor({ ...body, packet: {} });
     if ("error" in config)
-      return json8(config, 400);
+      return json9(config, 400);
     const model = buildModel(config.text);
     const results = suite.packets.map((entry) => {
       const result = tracePacket({ model, packet: entry.packet });
@@ -64683,7 +64875,7 @@ ${body.changes}
         summary: result.summary
       };
     });
-    return json8({
+    return json9({
       source: config.source,
       suite: { id: suite.id, name: suite.name },
       results,
@@ -64691,12 +64883,12 @@ ${body.changes}
       total: results.length
     });
   }
-  return json8({ error: "not found" }, 404);
+  return json9({ error: "not found" }, 404);
 }
 
 // src/observability/schedule-routes.ts
 var JSON_HEADERS8 = { "content-type": "application/json; charset=utf-8" };
-function json9(body, status = 200) {
+function json10(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS8 });
 }
 function latestPerDevice2(runs) {
@@ -64773,12 +64965,12 @@ async function scheduleRoutes(req, url) {
   try {
     store = await scheduleStore();
   } catch (e) {
-    return json9({ error: e instanceof Error ? e.message : String(e), jobs: [] }, 503);
+    return json10({ error: e instanceof Error ? e.message : String(e), jobs: [] }, 503);
   }
   const now = Date.now();
   if (p === "/api/schedules" && req.method === "GET") {
     const jobs = store.listJobs().map((job) => jobRow(job, store.runs(job.id, 500), now));
-    return json9({
+    return json10({
       jobs,
       schedulable: schedulableTools().map((a) => ({ tool: a.tool, summary: a.summary }))
     });
@@ -64786,20 +64978,20 @@ async function scheduleRoutes(req, url) {
   if (p === "/api/schedules" && req.method === "POST") {
     const body = await req.json().catch(() => null);
     if (!body)
-      return json9({ error: "invalid JSON body" }, 400);
+      return json10({ error: "invalid JSON body" }, 400);
     const parsed = JobSchema.safeParse(body);
     if (!parsed.success) {
-      return json9({
+      return json10({
         error: parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ")
       }, 400);
     }
     if (!auditAdapter(parsed.data.tool)) {
-      return json9({ error: `'${parsed.data.tool}' is not a schedulable auditor` }, 400);
+      return json10({ error: `'${parsed.data.tool}' is not a schedulable auditor` }, 400);
     }
     await primeRiskIndex();
     const risk = liveExecutor().riskOf(parsed.data.tool);
     if (risk !== "READ") {
-      return json9({ error: `'${parsed.data.tool}' is annotated ${risk}; only READ may be scheduled` }, 400);
+      return json10({ error: `'${parsed.data.tool}' is annotated ${risk}; only READ may be scheduled` }, 400);
     }
     const existing = store.getJob(parsed.data.id);
     const job = { ...parsed.data, createdAt: existing?.createdAt ?? now };
@@ -64808,7 +65000,7 @@ async function scheduleRoutes(req, url) {
       armJob(job, now);
     else
       forgetJob(job.id);
-    return json9({ job: jobRow(job, store.runs(job.id, 500), now), replaced: existing !== null });
+    return json10({ job: jobRow(job, store.runs(job.id, 500), now), replaced: existing !== null });
   }
   if (p === "/api/schedules/timeline" && req.method === "GET") {
     const jobId = url.searchParams.get("job") ?? undefined;
@@ -64816,7 +65008,7 @@ async function scheduleRoutes(req, url) {
     const days = Number(url.searchParams.get("days") ?? 30);
     const since = now - days * 86400000;
     const runs = store.runs(jobId, 2000).filter((r) => r.startedAt >= since && (!device || r.device === device));
-    return json9({
+    return json10({
       points: runs.map((r) => ({
         at: r.startedAt,
         jobId: r.jobId,
@@ -64836,30 +65028,30 @@ async function scheduleRoutes(req, url) {
     const limit = Number(url.searchParams.get("limit") ?? 50);
     const jobs = jobId ? [jobId] : store.listJobs().map((j) => j.id);
     const items = jobs.flatMap((id) => regressionsFor(store.runs(id, 500), id)).sort((a, b) => b.at - a.at).slice(0, limit);
-    return json9({ regressions: items });
+    return json10({ regressions: items });
   }
   const parts = p.slice("/api/schedules/".length).split("/").filter(Boolean);
   if (parts.length === 0 || parts.length > 2)
-    return json9({ error: "not found" }, 404);
+    return json10({ error: "not found" }, 404);
   const id = decodeURIComponent(parts[0]);
   const verb = parts[1];
   if (!verb && req.method === "DELETE") {
     const job = store.getJob(id);
     if (!job)
-      return json9({ error: `no schedule '${id}'` }, 404);
+      return json10({ error: `no schedule '${id}'` }, 404);
     const runCount = store.runs(id, 1e4).length;
     store.removeJob(id);
     forgetJob(id);
-    return json9({ removed: id, runsDiscarded: runCount });
+    return json10({ removed: id, runsDiscarded: runCount });
   }
   if (verb === "run" && req.method === "POST") {
     const job = store.getJob(id);
     if (!job)
-      return json9({ error: `no schedule '${id}'` }, 404);
+      return json10({ error: `no schedule '${id}'` }, 404);
     await primeRiskIndex();
     logger.info(`schedule '${id}' run requested from the dashboard`);
     const result = await runJob(job, liveExecutor(), runnerOptions());
-    return json9({
+    return json10({
       ...result,
       job: jobRow(job, store.runs(id, 500), Date.now())
     });
@@ -64867,16 +65059,16 @@ async function scheduleRoutes(req, url) {
   if (!verb && req.method === "GET") {
     const job = store.getJob(id);
     if (!job)
-      return json9({ error: `no schedule '${id}'` }, 404);
+      return json10({ error: `no schedule '${id}'` }, 404);
     const runs = store.runs(id, 500);
-    return json9({ job: jobRow(job, runs, now), runs, regressions: regressionsFor(runs, id) });
+    return json10({ job: jobRow(job, runs, now), runs, regressions: regressionsFor(runs, id) });
   }
-  return json9({ error: "not found" }, 404);
+  return json10({ error: "not found" }, 404);
 }
 
 // src/observability/explain-routes.ts
 var JSON_HEADERS9 = { "content-type": "application/json; charset=utf-8" };
-function json10(body, status = 200) {
+function json11(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS9 });
 }
 var storePromise17 = null;
@@ -64917,52 +65109,52 @@ async function explainRoutes(req, url) {
   if (p === "/api/explain/diff" && req.method === "POST") {
     const body = await req.json().catch(() => null);
     if (!body)
-      return json10({ error: "invalid JSON body" }, 400);
+      return json11({ error: "invalid JSON body" }, 400);
     if (!body.before && !body.beforeText) {
-      return json10({ error: "a diff needs a baseline: pass `before` (a snapshot id) or `beforeText`" }, 400);
+      return json11({ error: "a diff needs a baseline: pass `before` (a snapshot id) or `beforeText`" }, 400);
     }
     const device = body.device ?? "";
     const before = body.beforeText ? { text: body.beforeText, device, source: "supplied text" } : await configFor2(device, body.before ?? null);
     if ("error" in before)
-      return json10({ error: `before: ${before.error}` }, before.status);
+      return json11({ error: `before: ${before.error}` }, before.status);
     const after = body.afterText ? { text: body.afterText, device, source: "supplied text" } : await configFor2(device, body.after ?? null);
     if ("error" in after)
-      return json10({ error: `after: ${after.error}` }, after.status);
+      return json11({ error: `after: ${after.error}` }, after.status);
     const diff = diffNarratives(analyzeDevice(before.text, before.device), analyzeDevice(after.text, after.device));
-    return json10({ diff, markdown: renderDiff(diff), before: before.source, after: after.source });
+    return json11({ diff, markdown: renderDiff(diff), before: before.source, after: after.source });
   }
   const rest = p.slice("/api/explain/".length).split("/").filter(Boolean);
   if (rest.length === 0)
-    return json10({ error: "not found" }, 404);
+    return json11({ error: "not found" }, 404);
   if (req.method !== "GET")
-    return json10({ error: "not found" }, 404);
+    return json11({ error: "not found" }, 404);
   const device = decodeURIComponent(rest[0]);
   const snapshotId = url.searchParams.get("snapshot");
   let config;
   try {
     config = await configFor2(device, snapshotId);
   } catch (e) {
-    return json10({ error: e instanceof Error ? e.message : String(e) }, 502);
+    return json11({ error: e instanceof Error ? e.message : String(e) }, 502);
   }
   if ("error" in config)
-    return json10({ error: config.error }, config.status);
+    return json11({ error: config.error }, config.status);
   const narrative = { ...analyzeDevice(config.text, config.device), generatedAt: Date.now() };
   if (rest.length === 1) {
-    return json10(payload(narrative, config.source, renderNarrative(narrative)));
+    return json11(payload(narrative, config.source, renderNarrative(narrative)));
   }
   if (rest[1] === "section" && rest[2]) {
     const section = decodeURIComponent(rest[2]);
     if (!NARRATIVE_SECTIONS.includes(section)) {
-      return json10({ error: `unknown section '${section}'. Known: ${NARRATIVE_SECTIONS.join(", ")}` }, 400);
+      return json11({ error: `unknown section '${section}'. Known: ${NARRATIVE_SECTIONS.join(", ")}` }, 400);
     }
-    return json10(payload(narrative, config.source, renderNarrative(narrative, { sections: [section] })));
+    return json11(payload(narrative, config.source, renderNarrative(narrative, { sections: [section] })));
   }
-  return json10({ error: "not found" }, 404);
+  return json11({ error: "not found" }, 404);
 }
 
 // src/observability/attack-routes.ts
 var JSON_HEADERS10 = { "content-type": "application/json; charset=utf-8" };
-function json11(body, status = 200) {
+function json12(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS10 });
 }
 async function attackRoutes(req, url) {
@@ -64973,7 +65165,7 @@ async function attackRoutes(req, url) {
   try {
     store = await attackStore();
   } catch (e) {
-    return json11({ error: e instanceof Error ? e.message : String(e), incidents: [] }, 503);
+    return json12({ error: e instanceof Error ? e.message : String(e), incidents: [] }, 503);
   }
   const cfg = getConfig().attacks;
   const now = Date.now();
@@ -64985,7 +65177,7 @@ async function attackRoutes(req, url) {
     });
     const responses = store.listResponses({ active: true, limit: 500 });
     const blocked = new Set(responses.map((r) => r.source));
-    return json11({
+    return json12({
       incidents: incidents.map((i) => ({ ...i, blocked: blocked.has(i.source) })),
       responses,
       posture: {
@@ -65025,7 +65217,7 @@ async function attackRoutes(req, url) {
       }
     }
     const active = new Set(store.listResponses({ active: true, limit: 500 }).map((r) => r.source));
-    return json11({
+    return json12({
       sources: [...bySource.values()].map((s) => ({
         source: s.source,
         devices: [...s.devices].sort(),
@@ -65043,14 +65235,14 @@ async function attackRoutes(req, url) {
     const guards = buildGuards();
     const never = [...neverBlockSet(guards)].sort();
     const check = url.searchParams.get("check");
-    return json11({
+    return json12({
       config: cfg,
       neverBlock: never,
       check: check ? { address: check, protected: isNeverBlock(check, new Set(never)) } : undefined
     });
   }
   if (p === "/api/attacks/config" && req.method === "POST") {
-    return json11({
+    return json12({
       error: "edit the `attacks` block in Config \u2014 the policy has to survive a restart, so it is not held in memory here"
     }, 501);
   }
@@ -65063,7 +65255,7 @@ async function attackRoutes(req, url) {
       onlineOnly: body.onlineOnly,
       respond: false
     });
-    return json11({
+    return json12({
       incidents: result.incidents,
       unavailable: result.unavailable,
       devices: result.devices,
@@ -65071,7 +65263,7 @@ async function attackRoutes(req, url) {
     });
   }
   if (p === "/api/attacks/devices" && req.method === "GET") {
-    return json11({
+    return json12({
       devices: listDevices().names.map((name) => ({
         name,
         reachable: getDeviceStatus(name).reachable
@@ -65084,24 +65276,24 @@ async function attackRoutes(req, url) {
     const response = store.responseFor(address);
     const devices = response?.devices ?? [];
     if (devices.length === 0)
-      return json11({ error: `no recorded block for ${address}` }, 404);
+      return json12({ error: `no recorded block for ${address}` }, 404);
     const results = await revokeBlock(address, devices, response?.list);
     store.revokeResponse(address, now);
-    return json11({ address, results });
+    return json12({ address, results });
   }
   if (rest.length === 1 && req.method === "GET") {
     const incident = store.getIncident(decodeURIComponent(rest[0]));
     if (!incident)
-      return json11({ error: "not found" }, 404);
-    return json11({ incident, response: store.responseFor(incident.source) });
+      return json12({ error: "not found" }, 404);
+    return json12({ incident, response: store.responseFor(incident.source) });
   }
   if (rest.length === 2 && rest[1] === "respond" && req.method === "POST") {
     const incident = store.getIncident(decodeURIComponent(rest[0]));
     if (!incident)
-      return json11({ error: "not found" }, 404);
+      return json12({ error: "not found" }, 404);
     const body = await req.json().catch(() => ({}));
     if (body.action === "dismiss") {
-      return json11({ dismissed: incident.id });
+      return json12({ dismissed: incident.id });
     }
     const decision = decide({
       incident,
@@ -65113,13 +65305,13 @@ async function attackRoutes(req, url) {
       timeout: body.timeout
     });
     if (!isPlan(decision)) {
-      return json11({ refused: true, guard: decision.guard, reason: decision.reason }, 200);
+      return json12({ refused: true, guard: decision.guard, reason: decision.reason }, 200);
     }
     if (decision.action === "escalate") {
-      return json11({ escalated: true, reason: decision.reason });
+      return json12({ escalated: true, reason: decision.reason });
     }
     if (!body.confirm) {
-      return json11({ dryRun: true, plan: decision });
+      return json12({ dryRun: true, plan: decision });
     }
     const applied = await executePlan(decision);
     const ok = applied.some((r) => r.ok);
@@ -65135,14 +65327,14 @@ async function attackRoutes(req, url) {
       ok,
       error: ok ? undefined : applied.map((r) => r.detail).join("; ")
     });
-    return json11({ applied, ok, plan: decision });
+    return json12({ applied, ok, plan: decision });
   }
-  return json11({ error: "not found" }, 404);
+  return json12({ error: "not found" }, 404);
 }
 
 // src/observability/alert-routes.ts
 var JSON_HEADERS11 = { "content-type": "application/json; charset=utf-8" };
-function json12(body, status = 200) {
+function json13(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS11 });
 }
 function ruleRow(rule, subject, status, since) {
@@ -65197,11 +65389,11 @@ async function alertRoutes(req, url, db) {
   const channels = getConfig().alerts?.channels;
   if (p === "/api/alerts" && req.method === "GET") {
     if (!engine) {
-      return json12({ configured: false, rules: [], active: [], channels: {} });
+      return json13({ configured: false, rules: [], active: [], channels: {} });
     }
     const now = Date.now();
     const rows = engine.snapshot().map(({ rule, subject, state }) => ruleRow(rule, subject, isMuted(rule, now) ? "muted" : !rule.enabled ? "disabled" : state.status, state.since));
-    return json12({
+    return json13({
       configured: true,
       rules: rows,
       active: rows.filter((r) => r.status === "firing"),
@@ -65210,41 +65402,41 @@ async function alertRoutes(req, url, db) {
   }
   if (p === "/api/alerts/history" && req.method === "GET") {
     if (!engine)
-      return json12({ history: [] });
+      return json13({ history: [] });
     const hours = Number(url.searchParams.get("hours") ?? 24);
     const history = await engine.history({
       sinceMs: Date.now() - hours * 3600000,
       ruleId: url.searchParams.get("rule") ?? undefined,
       limit: Number(url.searchParams.get("limit") ?? 200)
     });
-    return json12({ history });
+    return json13({ history });
   }
   if (p === "/api/alerts/rules" && req.method === "POST") {
     if (!engine)
-      return json12({ error: "alerting is not configured" }, 400);
+      return json13({ error: "alerting is not configured" }, 400);
     const parsed = AlertRuleSchema.safeParse(await req.json());
     if (!parsed.success) {
-      return json12({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+      return json13({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
     }
     const rules = engine.configuredRules();
     if (rules.some((r) => r.id === parsed.data.id)) {
-      return json12({ error: `rule '${parsed.data.id}' already exists` }, 409);
+      return json13({ error: `rule '${parsed.data.id}' already exists` }, 409);
     }
     engine.setRules([...rules, parsed.data]);
-    return json12({ ok: true, id: parsed.data.id });
+    return json13({ ok: true, id: parsed.data.id });
   }
   const idMatch = p.match(/^\/api\/alerts\/rules\/([^/]+)$/);
   if (idMatch) {
     if (!engine)
-      return json12({ error: "alerting is not configured" }, 400);
+      return json13({ error: "alerting is not configured" }, 400);
     const id = decodeURIComponent(idMatch[1]);
     const rules = engine.configuredRules();
     const existing = rules.find((r) => r.id === id);
     if (!existing)
-      return json12({ error: `unknown rule: ${id}` }, 404);
+      return json13({ error: `unknown rule: ${id}` }, 404);
     if (req.method === "DELETE") {
       engine.setRules(rules.filter((r) => r.id !== id));
-      return json12({ ok: true });
+      return json13({ ok: true });
     }
     if (req.method === "PATCH") {
       const body = await req.json();
@@ -65252,22 +65444,22 @@ async function alertRoutes(req, url, db) {
       if (typeof body.mute === "string") {
         const ms = parseDuration(body.mute);
         if (ms === null)
-          return json12({ error: `invalid duration: ${body.mute}` }, 400);
+          return json13({ error: `invalid duration: ${body.mute}` }, 400);
         mutedUntil = ms === 0 ? undefined : Date.now() + ms;
         delete body.mute;
       }
       const merged = AlertRuleSchema.safeParse({ ...existing, ...body, mutedUntil });
       if (!merged.success) {
-        return json12({ error: merged.error.issues.map((i) => i.message).join("; ") }, 400);
+        return json13({ error: merged.error.issues.map((i) => i.message).join("; ") }, 400);
       }
       engine.setRules(rules.map((r) => r.id === id ? merged.data : r));
-      return json12({ ok: true, rule: merged.data });
+      return json13({ ok: true, rule: merged.data });
     }
   }
   if (p === "/api/alerts/test" && req.method === "POST") {
     const body = await req.json();
     if (!channels || !body?.channel)
-      return json12({ error: "channel is required" }, 400);
+      return json13({ error: "channel is required" }, 400);
     try {
       const result = await deliver(body.channel, channels, {
         ruleId: "test",
@@ -65277,20 +65469,20 @@ async function alertRoutes(req, url, db) {
         body: "If you can read this, this channel is configured correctly.",
         at: Date.now()
       });
-      return json12(result);
+      return json13(result);
     } catch (e) {
       logger.error(`Alert channel test failed: ${logError(e)}`);
-      return json12({ error: clientError(e) }, 502);
+      return json13({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/alerts/preview" && req.method === "POST") {
     const parsed = AlertRuleSchema.safeParse(await req.json());
     if (!parsed.success) {
-      return json12({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
+      return json13({ error: parsed.error.issues.map((i) => i.message).join("; ") }, 400);
     }
     const hours = Number(url.searchParams.get("hours") ?? 24);
     if (!db) {
-      return json12({ hours, sampled: 0, fires: 0, resolves: 0, matched: 0, noHistory: true });
+      return json13({ hours, sampled: 0, fires: 0, resolves: 0, matched: 0, noHistory: true });
     }
     const events = db.query({ since: Date.now() - hours * 3600000, limit: 5000 }).map((e) => ({
       ts: e.ts,
@@ -65299,14 +65491,14 @@ async function alertRoutes(req, url, db) {
       risk: e.risk,
       isError: e.isError
     }));
-    return json12({ hours, sampled: events.length, ...previewRule(parsed.data, events) });
+    return json13({ hours, sampled: events.length, ...previewRule(parsed.data, events) });
   }
   return null;
 }
 
 // src/observability/memory-routes.ts
 var JSON_HEADERS12 = { "content-type": "application/json; charset=utf-8" };
-function json13(body, status = 200) {
+function json14(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS12 });
 }
 async function bodyJson4(req) {
@@ -65318,7 +65510,7 @@ async function memoryRoutes(req, url) {
     return null;
   const cfg = getConfig();
   if (!cfg.memory.enabled) {
-    return json13({ error: "Knowledge-graph memory is disabled" }, 503);
+    return json14({ error: "Knowledge-graph memory is disabled" }, 503);
   }
   if (p === "/api/memory/config" && req.method === "GET") {
     let stats = null;
@@ -65326,7 +65518,7 @@ async function memoryRoutes(req, url) {
       const store = await getMemoryStore();
       stats = store.stats();
     } catch {}
-    return json13({
+    return json14({
       enabled: cfg.memory.enabled,
       dbPath: cfg.memory.dbPath,
       stats
@@ -65340,7 +65532,7 @@ async function memoryRoutes(req, url) {
       try {
         await reopenMemoryStore(body.dbPath);
       } catch (e) {
-        return json13({
+        return json14({
           error: `Failed to open memory DB at ${body.dbPath}: ${e instanceof Error ? e.message : String(e)}`
         }, 400);
       }
@@ -65362,7 +65554,7 @@ async function memoryRoutes(req, url) {
       const store = await getMemoryStore();
       stats = store.stats();
     } catch {}
-    return json13({
+    return json14({
       ok: true,
       enabled: getConfig().memory.enabled,
       dbPath: getConfig().memory.dbPath,
@@ -65371,58 +65563,58 @@ async function memoryRoutes(req, url) {
   }
   const store = await getMemoryStore();
   if (p === "/api/memory/graph" && req.method === "GET") {
-    return json13(store.readGraph());
+    return json14(store.readGraph());
   }
   if (p === "/api/memory/stats" && req.method === "GET") {
-    return json13(store.stats());
+    return json14(store.stats());
   }
   if (p === "/api/memory/search" && req.method === "GET") {
     const q = url.searchParams.get("q") || "";
     const limit = Number(url.searchParams.get("limit") ?? 50);
-    return json13(store.searchNodes(q, limit));
+    return json14(store.searchNodes(q, limit));
   }
   if (p === "/api/memory/activity" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 50);
     const since = url.searchParams.get("since");
-    return json13(store.activity(limit, since ? Number(since) : undefined));
+    return json14(store.activity(limit, since ? Number(since) : undefined));
   }
   const entityMatch = p.match(/^\/api\/memory\/entity\/(.+)$/);
   if (entityMatch && req.method === "GET") {
     const name = decodeURIComponent(entityMatch[1]);
     const graph = store.openNodes([name]);
     if (graph.entities.length === 0)
-      return json13({ error: "Entity not found" }, 404);
-    return json13({ entity: graph.entities[0], relations: graph.relations });
+      return json14({ error: "Entity not found" }, 404);
+    return json14({ entity: graph.entities[0], relations: graph.relations });
   }
   if (p === "/api/memory/entities" && req.method === "POST") {
     const body = await bodyJson4(req);
     const created = store.createEntities(body.entities ?? []);
-    return json13({ created, count: created.length });
+    return json14({ created, count: created.length });
   }
   if (p === "/api/memory/relations" && req.method === "POST") {
     const body = await bodyJson4(req);
     const created = store.createRelations(body.relations ?? []);
-    return json13({ created, count: created.length });
+    return json14({ created, count: created.length });
   }
   if (p === "/api/memory/observations" && req.method === "POST") {
     const body = await bodyJson4(req);
     const results = store.addObservations(body.observations ?? []);
-    return json13({ results });
+    return json14({ results });
   }
   if (p === "/api/memory/entities" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store.deleteEntities(body.names ?? []);
-    return json13({ removed });
+    return json14({ removed });
   }
   if (p === "/api/memory/relations" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store.deleteRelations(body.relations ?? []);
-    return json13({ removed });
+    return json14({ removed });
   }
   if (p === "/api/memory/observations" && req.method === "DELETE") {
     const body = await bodyJson4(req);
     const removed = store.deleteObservations(body.deletions ?? []);
-    return json13({ removed });
+    return json14({ removed });
   }
   return null;
 }
@@ -65430,7 +65622,7 @@ async function memoryRoutes(req, url) {
 // src/observability/dashboard.ts
 var SERVER_TAG3 = "mikrotik-mcp";
 var JSON_HEADERS13 = { "content-type": "application/json; charset=utf-8" };
-function json14(body, status = 200) {
+function json15(body, status = 200) {
   return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS13 });
 }
 function restartProcess() {
@@ -65611,25 +65803,7 @@ function topologyPayload() {
   };
 }
 function configPayload() {
-  const cfg = getConfig();
-  return redact({
-    devices: cfg.devices,
-    defaultDevice: cfg.defaultDevice,
-    mcp: cfg.mcp,
-    s3: cfg.s3,
-    dashboard: cfg.dashboard,
-    ssh: cfg.ssh,
-    alerts: cfg.alerts,
-    flows: cfg.flows,
-    policy: cfg.policy,
-    schedules: cfg.schedules,
-    attacks: cfg.attacks,
-    readOnly: cfg.readOnly,
-    tools: cfg.tools,
-    memory: cfg.memory,
-    backupDir: cfg.backupDir,
-    disableUpdateCheck: cfg.disableUpdateCheck
-  });
+  return redact(getConfig());
 }
 function sseResponse(transportLabel) {
   let unsub;
@@ -65731,11 +65905,11 @@ function issues(error) {
 async function configRoutes(req, url, admin) {
   const p = url.pathname;
   if (p === "/api/config-schema" && req.method === "GET") {
-    return json14(configSchemaJson());
+    return json15(configSchemaJson());
   }
   if (p === "/api/config/validate" && req.method === "POST") {
     const merged = mergeSecrets(await readJson(req), getConfig());
-    return json14(validateConfig(merged));
+    return json15(validateConfig(merged));
   }
   if (p === "/api/config/test-device" && req.method === "POST") {
     const body = await readJson(req);
@@ -65744,22 +65918,22 @@ async function configRoutes(req, url, admin) {
     const merged = mergeSecrets(body?.config, currentDc);
     const parsed = DeviceConfigSchema.safeParse(merged);
     if (!parsed.success)
-      return json14({ ok: false, errors: issues(parsed.error) }, 400);
+      return json15({ ok: false, errors: issues(parsed.error) }, 400);
     const status = await probeDevice2(`config-test:${name}`, parsed.data);
-    return json14({ ok: true, status });
+    return json15({ ok: true, status });
   }
   if (p === "/api/config/preview" && req.method === "POST") {
     const before = JSON.stringify(redact(getConfig()), null, 2);
     const after = JSON.stringify(await readJson(req) ?? {}, null, 2);
     const d = diffLines(before, after, { fromLabel: "current", toLabel: "edited" });
-    return json14({ summary: d.summary, unified: d.unified });
+    return json15({ summary: d.summary, unified: d.unified });
   }
   if (p === "/api/config" && req.method === "POST") {
     const body = await readJson(req);
     const merged = mergeSecrets(body?.config, getConfig());
     const v = validateConfig(merged);
     if (!v.ok || !v.value)
-      return json14({ ok: false, errors: v.errors }, 400);
+      return json15({ ok: false, errors: v.errors }, 400);
     const prev = getConfig();
     const before = JSON.stringify(redact(prev), null, 2);
     const after = JSON.stringify(redact(v.value), null, 2);
@@ -65768,25 +65942,25 @@ async function configRoutes(req, url, admin) {
     const nextDevs = Object.keys(v.value.devices);
     const devicesChanged = prevDevs.length !== nextDevs.length || prevDevs.some((d) => !nextDevs.includes(d));
     const res = admin.applyConfig(v.value, clampRollback(body?.rollbackMs));
-    return json14({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
+    return json15({ ok: true, ...res, devicesChanged, summary: diff.summary, unified: diff.unified });
   }
   if (p === "/api/config/keep" && req.method === "POST") {
     const body = await readJson(req);
     const kept = admin.keepConfig(String(body?.pendingId ?? ""));
     if (kept)
       recordVersion(getConfig(), "auto", Date.now());
-    return json14({ kept });
+    return json15({ kept });
   }
   if (p === "/api/config/rollback" && req.method === "POST") {
     const body = await readJson(req);
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
-    return json14({ rolledBack, config: redact(getConfig()) });
+    return json15({ rolledBack, config: redact(getConfig()) });
   }
   if (p === "/api/reload" && req.method === "POST") {
     const body = await readJson(req);
     if (body?.hard === true) {
       const relaunched = restartProcess();
-      return json14({
+      return json15({
         ok: true,
         mode: "restart",
         note: relaunched ? "Restarting now \u2014 a fresh server process was launched and will bind the same port(s) in ~1.5s. Reconnect shortly." : "Could not self-relaunch; the process is exiting. It only comes back if a supervisor respawns it."
@@ -65797,10 +65971,10 @@ async function configRoutes(req, url, admin) {
       setConfig(cfg);
       const devices = Object.keys(cfg.devices);
       logger.info(`Config reloaded from source \u2014 ${devices.length} device(s): ${devices.join(", ")}`);
-      return json14({ ok: true, mode: "config", count: devices.length, devices });
+      return json15({ ok: true, mode: "config", count: devices.length, devices });
     } catch (e) {
       logger.error(`Config reload failed: ${logError(e)}`);
-      return json14({ ok: false, error: clientError(e) }, 500);
+      return json15({ ok: false, error: clientError(e) }, 500);
     }
   }
   if (p === "/api/config/history" && req.method === "GET") {
@@ -65816,55 +65990,55 @@ async function configRoutes(req, url, admin) {
       } catch {}
       return { ...v, drift: { added, removed } };
     });
-    return json14({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
+    return json15({ versions, bytes: historyBytes(), retention: AUTO_RETENTION });
   }
   if (p === "/api/config/history/get" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json14({ error: "id required" }, 400);
+      return json15({ error: "id required" }, 400);
     try {
       const v = readVersion(id);
-      return json14({
+      return json15({
         ts: v.ts,
         kind: v.kind,
         label: v.label,
         config: JSON.stringify(redact(v.config), null, 2)
       });
     } catch {
-      return json14({ error: "not found" }, 404);
+      return json15({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/diff" && req.method === "GET") {
     const id = url.searchParams.get("id");
     if (!id)
-      return json14({ error: "id required" }, 400);
+      return json15({ error: "id required" }, 400);
     try {
       const before = JSON.stringify(redact(readVersion(id).config), null, 2);
       const after = JSON.stringify(redact(getConfig()), null, 2);
       const d = diffLines(before, after, { fromLabel: "this version", toLabel: "current" });
-      return json14({ summary: d.summary, unified: d.unified });
+      return json15({ summary: d.summary, unified: d.unified });
     } catch {
-      return json14({ error: "not found" }, 404);
+      return json15({ error: "not found" }, 404);
     }
   }
   if (p === "/api/config/history/checkpoint" && req.method === "POST") {
     const b = await readJson(req);
     const label = b?.label?.trim() || "checkpoint";
-    return json14({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
+    return json15({ ok: true, version: recordVersion(getConfig(), "checkpoint", Date.now(), label) });
   }
   if (p === "/api/config/history/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json14({ error: "id required" }, 400);
+      return json15({ error: "id required" }, 400);
     let target;
     try {
       target = readVersion(b.id);
     } catch {
-      return json14({ error: "not found" }, 404);
+      return json15({ error: "not found" }, 404);
     }
     const v = validateConfig(target.config);
     if (!v.ok || !v.value)
-      return json14({ ok: false, errors: v.errors }, 400);
+      return json15({ ok: false, errors: v.errors }, 400);
     recordVersion(getConfig(), "auto", Date.now(), "before restore");
     setConfig(v.value);
     let persisted = true;
@@ -65875,13 +66049,13 @@ async function configRoutes(req, url, admin) {
     }
     const label = target.label ? `restored "${target.label}"` : `restored ${b.id}`;
     recordVersion(getConfig(), "auto", Date.now(), label);
-    return json14({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
+    return json15({ ok: true, persisted, restored: b.id, config: redact(getConfig()) });
   }
   if (p === "/api/config/history/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.id)
-      return json14({ error: "id required" }, 400);
-    return deleteVersion(b.id) ? json14({ ok: true }) : json14({ error: "not found" }, 404);
+      return json15({ error: "id required" }, 400);
+    return deleteVersion(b.id) ? json15({ ok: true }) : json15({ error: "not found" }, 404);
   }
   return null;
 }
@@ -65892,7 +66066,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules" && req.method === "GET") {
     const cfg = getConfig();
     const src = getConfigSource();
-    return json14({
+    return json15({
       ...moduleSurface(cfg.tools),
       filter: cfg.tools,
       source: src,
@@ -65902,11 +66076,11 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/toggle" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.slug !== "string" || typeof b?.enabled !== "boolean") {
-      return json14({ error: "slug (string) and enabled (boolean) are required" }, 400);
+      return json15({ error: "slug (string) and enabled (boolean) are required" }, 400);
     }
     const mod = moduleCatalog2.find((m) => m.slug.toLowerCase() === b.slug.toLowerCase());
     if (!mod)
-      return json14({ error: `unknown module: ${b.slug}` }, 404);
+      return json15({ error: `unknown module: ${b.slug}` }, 404);
     const cfg = getConfig();
     const nextTools = ToolFilterSchema.parse(applyModuleToggle(cfg.tools, mod.slug, b.enabled));
     const next = { ...cfg, tools: nextTools };
@@ -65922,7 +66096,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `module ${b.enabled ? "enabled" : "disabled"}: ${mod.slug}`);
     }
-    return json14({
+    return json15({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -65937,7 +66111,7 @@ async function modulesRoutes(req, url) {
   if (p === "/api/modules/app-views" && req.method === "POST") {
     const b = await readJson(req);
     if (typeof b?.enabled !== "boolean") {
-      return json14({ error: "enabled (boolean) is required" }, 400);
+      return json15({ error: "enabled (boolean) is required" }, 400);
     }
     const cfg = getConfig();
     const next = { ...cfg, mcp: { ...cfg.mcp, appViews: b.enabled } };
@@ -65953,7 +66127,7 @@ async function modulesRoutes(req, url) {
     if (persisted) {
       recordVersion(getConfig(), "auto", Date.now(), `app views ${b.enabled ? "enabled" : "disabled"}`);
     }
-    return json14({
+    return json15({
       ok: true,
       persisted,
       requiresReconnect: true,
@@ -65967,11 +66141,11 @@ async function modulesRoutes(req, url) {
 async function captureRoutes(req, url) {
   const p = url.pathname;
   if (p === "/api/capture/status" && req.method === "GET") {
-    return json14(capture2.stats());
+    return json15(capture2.stats());
   }
   if (p === "/api/capture/packets" && req.method === "GET") {
     const limit = Number(url.searchParams.get("limit") ?? 200) || 200;
-    return json14({ packets: capture2.recent(limit), stats: capture2.stats() });
+    return json15({ packets: capture2.recent(limit), stats: capture2.stats() });
   }
   if (p === "/api/capture/pcap" && req.method === "GET") {
     return new Response(capture2.pcap(), {
@@ -65983,11 +66157,11 @@ async function captureRoutes(req, url) {
   }
   if (p === "/api/capture/start" && req.method === "POST") {
     const body = await readJson(req);
-    return json14(await capture2.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
+    return json15(await capture2.start(typeof body?.port === "number" ? body.port : DEFAULT_TZSP_PORT));
   }
   if (p === "/api/capture/stop" && req.method === "POST") {
     capture2.stop();
-    return json14({ ok: true, ...capture2.stats() });
+    return json15({ ok: true, ...capture2.stats() });
   }
   return null;
 }
@@ -65999,24 +66173,24 @@ async function capsmanRoutes(req, url) {
   if (req.method === "GET") {
     const ctx = createContext(undefined, url.searchParams.get("device") ?? undefined);
     if (p === "/api/capsman/overview") {
-      return json14(capsmanOverview(await fetchCapsmanState(ctx)));
+      return json15(capsmanOverview(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/clients") {
       const state = await fetchCapsmanState(ctx);
       const weakDbm = Number.parseInt(url.searchParams.get("weak_dbm") ?? "", 10);
       const weak = reportWeakClients(state, Number.isFinite(weakDbm) ? weakDbm : undefined);
-      return json14({ clients: state.clients, weak });
+      return json15({ clients: state.clients, weak });
     }
     if (p === "/api/capsman/audit") {
-      return json14(runCapsmanAudit(await fetchCapsmanState(ctx)));
+      return json15(runCapsmanAudit(await fetchCapsmanState(ctx)));
     }
     if (p === "/api/capsman/trends") {
       if (!capsmanStore)
-        return json14({ error: "capsman store not active" }, 503);
+        return json15({ error: "capsman store not active" }, 503);
       const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
       const days = daysParam(url, 7, 30);
       const series = capsmanStore.radioSeries(device, Date.now() - days * 86400000);
-      return json14({ series, days });
+      return json15({ series, days });
     }
     return null;
   }
@@ -66027,45 +66201,45 @@ async function capsmanRoutes(req, url) {
     if (p === "/api/capsman/apply/steer") {
       const client = state.clients.find((c) => c.mac.toLowerCase() === (body.mac ?? "").toLowerCase());
       if (!client)
-        return json14({ ok: false, error: "client not associated" }, 400);
+        return json15({ ok: false, error: "client not associated" }, 400);
       if (steerAlreadyPresent(state, body.mac ?? "")) {
-        return json14({ ok: true, message: "already steered (no-op)" });
+        return json15({ ok: true, message: "already steered (no-op)" });
       }
       const mode = body.mode === "soft" ? "soft" : "hard";
       const commands = buildSteerCommands(state, body.mac ?? "", client.radioId, mode);
       if (!body.confirm)
-        return json14({ ok: true, preview: commands });
-      return json14(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
+        return json15({ ok: true, preview: commands });
+      return json15(await applyCapsmanWrites(ctx, commands, `pre-steer-${body.mac}`));
     }
     if (p === "/api/capsman/apply/load-balance") {
       const plan = loadBalancePlan(state);
       const commands = buildLoadBalanceCommands(state, plan);
       if (!body.confirm)
-        return json14({ ok: true, preview: commands, plan });
-      return json14(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
+        return json15({ ok: true, preview: commands, plan });
+      return json15(await applyCapsmanWrites(ctx, commands, "pre-load-balance"));
     }
     if (p === "/api/capsman/apply/channel-plan") {
       if (state.path === "/caps-man") {
-        return json14({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
+        return json15({ ok: false, error: "channel-plan apply is v7 /interface wifi only" }, 400);
       }
       const commands = buildChannelPlanCommands(state);
       if (!body.confirm)
-        return json14({ ok: true, preview: commands });
-      return json14(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
+        return json15({ ok: true, preview: commands });
+      return json15(await applyCapsmanWrites(ctx, commands, "pre-channel-plan"));
     }
     if (p === "/api/capsman/apply/ft") {
       const commands = buildFtCommands(state);
       if (!body.confirm)
-        return json14({ ok: true, preview: commands });
-      return json14(await applyCapsmanWrites(ctx, commands, "pre-ft"));
+        return json15({ ok: true, preview: commands });
+      return json15(await applyCapsmanWrites(ctx, commands, "pre-ft"));
     }
     if (p === "/api/capsman/apply/ha") {
       const commands = buildHaCommands(state);
       const guidance = haGuidance(state);
       if (!body.confirm)
-        return json14({ ok: true, preview: commands, guidance });
+        return json15({ ok: true, preview: commands, guidance });
       const res = await applyCapsmanWrites(ctx, commands, "pre-ha");
-      return json14({ ...res, guidance });
+      return json15({ ...res, guidance });
     }
   }
   return null;
@@ -66091,32 +66265,32 @@ async function clientsRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (p === "/api/clients" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json14(devicesView(await fetchDevices(ctx)));
+    return json15(devicesView(await fetchDevices(ctx)));
   }
   if (p === "/api/clients/traffic" && req.method === "GET") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json14({ error: "ip required" }, 400);
+      return json15({ error: "ip required" }, 400);
     const ctx = createContext(undefined, deviceFromQuery());
-    return json14(await sampleDeviceTraffic(ctx, ip));
+    return json15(await sampleDeviceTraffic(ctx, ip));
   }
   if (p === "/api/clients/traffic-bulk" && req.method === "GET") {
     const ctx = createContext(undefined, deviceFromQuery());
-    return json14(await sampleAllTraffic(ctx));
+    return json15(await sampleAllTraffic(ctx));
   }
   if (req.method === "POST") {
     const b = await readJson(req);
     const ctx = createContext(undefined, b?.device);
     if (p === "/api/clients/limits") {
       if (!b?.ip)
-        return json14({ error: "ip required" }, 400);
-      return json14(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
+        return json15({ error: "ip required" }, 400);
+      return json15(await setDeviceLimits(ctx, b.ip, { download: b.download, upload: b.upload }));
     }
     if (!b?.mac)
-      return json14({ error: "mac required" }, 400);
+      return json15({ error: "mac required" }, 400);
     const run = async (op) => {
       const r = await op;
-      return json14({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
+      return json15({ ...r, view: r.ok ? devicesView(await fetchDevices(ctx)) : undefined });
     };
     if (p === "/api/clients/block")
       return run(blockDevice(ctx, b.mac, b.comment));
@@ -66128,12 +66302,12 @@ async function clientsRoutes(req, url) {
       return run(removeDeviceLease(ctx, b.mac));
     if (p === "/api/clients/set-ip") {
       if (!b.ip)
-        return json14({ error: "ip required" }, 400);
+        return json15({ error: "ip required" }, 400);
       return run(setDeviceIp(ctx, b.mac, b.ip));
     }
     if (p === "/api/clients/label") {
       if (typeof b.label !== "string")
-        return json14({ error: "label required" }, 400);
+        return json15({ error: "label required" }, 400);
       return run(setDeviceLabel(ctx, b.mac, b.label));
     }
   }
@@ -66146,20 +66320,20 @@ async function aaaRoutes(req, url) {
   const deviceFromQuery = () => url.searchParams.get("device") ?? undefined;
   if (req.method === "GET") {
     if (p === "/api/aaa/entities") {
-      return json14({ entities: AAA_ENTITIES });
+      return json15({ entities: AAA_ENTITIES });
     }
     if (p === "/api/aaa/radius-incoming") {
-      return json14(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
+      return json15(await getRadiusIncoming(createContext(undefined, deviceFromQuery())));
     }
     if (p === "/api/aaa/um-settings") {
-      return json14(await getUmSettings(createContext(undefined, deviceFromQuery())));
+      return json15(await getUmSettings(createContext(undefined, deviceFromQuery())));
     }
     const listMatch = p.match(/^\/api\/aaa\/list\/([\w-]+)$/);
     if (listMatch) {
       const slug = listMatch[1];
       if (!AAA_ENTITIES[slug])
-        return json14({ error: "unknown entity" }, 404);
-      return json14(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
+        return json15({ error: "unknown entity" }, 404);
+      return json15(await listAaaEntity(createContext(undefined, deviceFromQuery()), slug));
     }
     return null;
   }
@@ -66167,30 +66341,30 @@ async function aaaRoutes(req, url) {
     const body = await readJson(req);
     const ctx = createContext(undefined, body?.device);
     if (p === "/api/aaa/radius-incoming")
-      return json14(await setRadiusIncoming(ctx, body?.fields ?? {}));
+      return json15(await setRadiusIncoming(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/um-settings")
-      return json14(await setUmSettings(ctx, body?.fields ?? {}));
+      return json15(await setUmSettings(ctx, body?.fields ?? {}));
     if (p === "/api/aaa/radius-reset-counters")
-      return json14(await resetRadiusCounters(ctx));
+      return json15(await resetRadiusCounters(ctx));
     const slug = body?.slug ?? "";
     if (!AAA_ENTITIES[slug])
-      return json14({ error: "unknown entity" }, 404);
+      return json15({ error: "unknown entity" }, 404);
     if (p === "/api/aaa/add")
-      return json14(await addAaaEntity(ctx, slug, body?.fields ?? {}));
+      return json15(await addAaaEntity(ctx, slug, body?.fields ?? {}));
     if (p === "/api/aaa/update") {
       if (!body?.id)
-        return json14({ error: "id required" }, 400);
-      return json14(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
+        return json15({ error: "id required" }, 400);
+      return json15(await updateAaaEntity(ctx, slug, body.id, body?.fields ?? {}));
     }
     if (p === "/api/aaa/remove") {
       if (!body?.id)
-        return json14({ error: "id required" }, 400);
-      return json14(await removeAaaEntity(ctx, slug, body.id));
+        return json15({ error: "id required" }, 400);
+      return json15(await removeAaaEntity(ctx, slug, body.id));
     }
     if (p === "/api/aaa/toggle") {
       if (!body?.id)
-        return json14({ error: "id required" }, 400);
-      return json14(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
+        return json15({ error: "id required" }, 400);
+      return json15(await toggleAaaEntity(ctx, slug, body.id, body?.enable === true));
     }
   }
   return null;
@@ -66206,43 +66380,43 @@ async function usageRoutes(req, url) {
     return null;
   if (p === "/api/usage/sampler") {
     if (req.method === "GET")
-      return json14({ intervalMs: getUsageSamplerInterval() });
+      return json15({ intervalMs: getUsageSamplerInterval() });
     if (req.method === "POST") {
       const b = await readJson(req);
       const applied = setUsageSamplerInterval(Number(b?.intervalMs));
-      return json14({ intervalMs: applied });
+      return json15({ intervalMs: applied });
     }
     return null;
   }
   if (req.method !== "GET")
     return null;
   if (!usageStore)
-    return json14({ error: "usage store not active" }, 503);
+    return json15({ error: "usage store not active" }, 503);
   const device = resolveDeviceName(url.searchParams.get("device") ?? undefined);
   const sinceTs = (days) => Date.now() - days * 86400000;
   if (p === "/api/usage/um-users") {
-    return json14({ users: usageStore.umUsers(device) });
+    return json15({ users: usageStore.umUsers(device) });
   }
   if (p === "/api/usage/client") {
     const ip = url.searchParams.get("ip");
     if (!ip)
-      return json14({ error: "ip required" }, 400);
+      return json15({ error: "ip required" }, 400);
     const series = usageStore.clientDailyUsage(device, ip, sinceTs(daysParam(url, 90, 400)));
-    return json14(withTotals(series));
+    return json15(withTotals(series));
   }
   if (p === "/api/usage/um-user") {
     const user = url.searchParams.get("user");
     if (!user)
-      return json14({ error: "user required" }, 400);
+      return json15({ error: "user required" }, 400);
     const series = usageStore.umUserDailyUsage(device, user, sinceTs(daysParam(url, 90, 400)));
-    return json14(withTotals(series));
+    return json15(withTotals(series));
   }
   if (p === "/api/usage/heatmap") {
     const user = url.searchParams.get("user");
     const days = usageStore.heatmap(device, user || null, sinceTs(daysParam(url, 371, 400)));
     const total = days.reduce((s, d) => s + d.count, 0);
     const max = days.reduce((m, d) => Math.max(m, d.count), 0);
-    return json14({ days, total, max });
+    return json15({ days, total, max });
   }
   return null;
 }
@@ -66266,13 +66440,13 @@ async function featureRoutes(req, url) {
     const cfg = getConfig();
     const all = Object.keys(cfg.devices).flatMap((d) => store.list(d, 200, false));
     all.sort((a, b) => b.ts - a.ts);
-    return json14({ snapshots: all });
+    return json15({ snapshots: all });
   }
   const snapMatch = p.match(/^\/api\/snapshot\/(.+)$/);
   if (snapMatch && req.method === "GET") {
     const store = await snapStore();
     const s = store.get(decodeURIComponent(snapMatch[1]));
-    return s ? json14(s) : json14({ error: "not found" }, 404);
+    return s ? json15(s) : json15({ error: "not found" }, 404);
   }
   if (p === "/api/snapshots/diff" && req.method === "POST") {
     const store = await snapStore();
@@ -66280,13 +66454,13 @@ async function featureRoutes(req, url) {
     const from = b?.from ? store.get(b.from) : null;
     const to = b?.to ? store.get(b.to) : null;
     if (!from || !to) {
-      return json14({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
+      return json15({ error: "both 'from' and 'to' snapshot ids are required" }, 400);
     }
     const diff = diffLines(normalizeExport(from.body), normalizeExport(to.body), {
       fromLabel: from.label ?? from.id,
       toLabel: to.label ?? to.id
     });
-    return json14({
+    return json15({
       from: { id: from.id, label: from.label, ts: from.ts, device: from.device },
       to: { id: to.id, label: to.label, ts: to.ts, device: to.device },
       summary: diff.summary,
@@ -66300,16 +66474,16 @@ async function featureRoutes(req, url) {
       ...b?.script ? splitCommands(b.script) : []
     ];
     if (commands.length === 0)
-      return json14({ error: "no commands provided" }, 400);
+      return json15({ error: "no commands provided" }, 400);
     const plan = buildChangePlan(commands);
-    return json14({ plan, text: renderPlan(plan) });
+    return json15({ plan, text: renderPlan(plan) });
   }
   if (p === "/api/s3" && req.method === "GET") {
-    return json14({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
+    return json15({ configured: isS3Configured(), target: isS3Configured() ? s3Target() : null });
   }
   if (p === "/api/s3/list" && req.method === "GET") {
     if (!isS3Configured())
-      return json14({ configured: false, objects: [] });
+      return json15({ configured: false, objects: [] });
     const prefix = url.searchParams.get("prefix") ?? "";
     try {
       const res = await getS3Client().list({ prefix: prefix || undefined, maxKeys: 1000 });
@@ -66318,42 +66492,42 @@ async function featureRoutes(req, url) {
         size: o.size ?? 0,
         lastModified: o.lastModified ?? null
       }));
-      return json14({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
+      return json15({ configured: true, target: s3Target(), objects, truncated: !!res.isTruncated });
     } catch (e) {
-      return json14({ error: clientError(e) }, 502);
+      return json15({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/presign" && req.method === "GET") {
     if (!isS3Configured())
-      return json14({ error: "S3 not configured" }, 400);
+      return json15({ error: "S3 not configured" }, 400);
     const key = url.searchParams.get("key");
     if (!key)
-      return json14({ error: "key required" }, 400);
+      return json15({ error: "key required" }, 400);
     try {
       const link = getS3Client().presign(key, { expiresIn: presignExpiresIn(), method: "GET" });
-      return json14({ url: link });
+      return json15({ url: link });
     } catch (e) {
-      return json14({ error: clientError(e) }, 502);
+      return json15({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/s3/delete" && req.method === "POST") {
     if (!isS3Configured())
-      return json14({ error: "S3 not configured" }, 400);
+      return json15({ error: "S3 not configured" }, 400);
     const b = await readJson(req);
     if (!b?.key)
-      return json14({ error: "key required" }, 400);
+      return json15({ error: "key required" }, 400);
     try {
       const client = getS3Client();
       if (!await client.exists(b.key))
-        return json14({ error: "not found" }, 404);
+        return json15({ error: "not found" }, 404);
       await client.delete(b.key);
-      return json14({ ok: true, key: b.key });
+      return json15({ ok: true, key: b.key });
     } catch (e) {
-      return json14({ error: clientError(e) }, 502);
+      return json15({ error: clientError(e) }, 502);
     }
   }
   if (p === "/api/backups" && req.method === "GET") {
-    return json14({
+    return json15({
       dir: backupDir(),
       devices: Object.keys(getConfig().devices),
       backups: listBackups()
@@ -66363,14 +66537,14 @@ async function featureRoutes(req, url) {
     const b = await readJson(req);
     const raw = b?.dir?.trim();
     if (!raw)
-      return json14({ error: "dir required" }, 400);
+      return json15({ error: "dir required" }, 400);
     const dir = raw === "~" || raw.startsWith("~/") ? join12(homedir5(), raw.slice(1)) : raw;
     const next = { ...getConfig(), backupDir: dir };
     setConfig(next);
     try {
       atomicWrite(getConfigSource().path, serializeConfig(next));
     } catch (e) {
-      return json14({
+      return json15({
         ok: true,
         dir: backupDir(),
         persisted: false,
@@ -66378,16 +66552,16 @@ async function featureRoutes(req, url) {
       });
     }
     recordVersion(getConfig(), "auto", Date.now(), "backup path changed");
-    return json14({ ok: true, dir: backupDir(), persisted: true });
+    return json15({ ok: true, dir: backupDir(), persisted: true });
   }
   if (p === "/api/backups/get" && req.method === "GET") {
     const name = url.searchParams.get("name");
     if (!name)
-      return json14({ error: "name required" }, 400);
+      return json15({ error: "name required" }, 400);
     try {
-      return json14({ name, content: readBackup(name) });
+      return json15({ name, content: readBackup(name) });
     } catch {
-      return json14({ error: "not found" }, 404);
+      return json15({ error: "not found" }, 404);
     }
   }
   if (p === "/api/backups/raw" && req.method === "GET") {
@@ -66408,41 +66582,41 @@ async function featureRoutes(req, url) {
   if (p === "/api/backups/upload" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || typeof b.content !== "string") {
-      return json14({ error: "name and content are required" }, 400);
+      return json15({ error: "name and content are required" }, 400);
     }
     try {
       const safe = b.name.endsWith(".rsc") ? b.name : `${b.name}.rsc`;
-      return json14({ ok: true, name: writeBackup(safe, b.content) });
+      return json15({ ok: true, name: writeBackup(safe, b.content) });
     } catch (e) {
-      return json14({ error: clientError(e) }, 400);
+      return json15({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/rename" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name || !b?.new_name)
-      return json14({ error: "name and new_name are required" }, 400);
+      return json15({ error: "name and new_name are required" }, 400);
     try {
-      return json14({ ok: true, name: renameBackup(b.name, b.new_name) });
+      return json15({ ok: true, name: renameBackup(b.name, b.new_name) });
     } catch (e) {
-      return json14({ error: clientError(e) }, 400);
+      return json15({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/delete" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json14({ error: "name required" }, 400);
+      return json15({ error: "name required" }, 400);
     try {
-      return deleteBackup(b.name) ? json14({ ok: true }) : json14({ error: "not found" }, 404);
+      return deleteBackup(b.name) ? json15({ ok: true }) : json15({ error: "not found" }, 404);
     } catch (e) {
-      return json14({ error: clientError(e) }, 400);
+      return json15({ error: clientError(e) }, 400);
     }
   }
   if (p === "/api/backups/restore" && req.method === "POST") {
     const b = await readJson(req);
     if (!b?.name)
-      return json14({ error: "name required" }, 400);
+      return json15({ error: "name required" }, 400);
     const device = resolveDeviceName(b.device);
-    return json14(await restoreLocalBackup(device, b.name, b.confirm === true));
+    return json15(await restoreLocalBackup(device, b.name, b.confirm === true));
   }
   if (p === "/api/backups/create" && req.method === "POST") {
     const b = await readJson(req);
@@ -66454,7 +66628,7 @@ async function featureRoutes(req, url) {
       compact: b?.compact === true,
       terse: b?.terse === true
     });
-    return r.ok ? json14(r) : json14({ error: r.error ?? "export failed" }, 502);
+    return r.ok ? json15(r) : json15({ error: r.error ?? "export failed" }, 502);
   }
   return null;
 }
@@ -66515,6 +66689,7 @@ async function runDashboard(cfg, transportLabel) {
     const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
     return bearer === cfg.token || url.searchParams.get("token") === cfg.token;
   };
+  const accessSettingsRoutes = createAccessSettingsRoutes(configAdmin);
   async function dashboardRoute(req, url, srv, ca, tl) {
     if (url.pathname === "/api/stream") {
       const traffic = url.searchParams.has("traffic") ? url.searchParams.get("traffic") ?? "" : undefined;
@@ -66526,6 +66701,9 @@ async function runDashboard(cfg, transportLabel) {
       const traffic = url.searchParams.has("traffic") ? url.searchParams.get("traffic") ?? "" : undefined;
       return traffic === undefined ? sseResponse(tl) : sseTrafficResponse(traffic, tl);
     }
+    const accessResp = await accessSettingsRoutes(req, url);
+    if (accessResp)
+      return accessResp;
     const configResp = await configRoutes(req, url, ca);
     if (configResp)
       return configResp;
@@ -66597,7 +66775,7 @@ async function runDashboard(cfg, transportLabel) {
       return memoryResp;
     const db = getEventStore();
     if (!db)
-      return json14({ error: "recorder not active" }, 503);
+      return json15({ error: "recorder not active" }, 503);
     if (url.pathname === "/api/events" && req.method === "DELETE") {
       let body = {};
       try {
@@ -66605,7 +66783,7 @@ async function runDashboard(cfg, transportLabel) {
       } catch {}
       const ids = Array.isArray(body.ids) ? body.ids.filter((x) => typeof x === "string") : [];
       const removed = body.all === true ? db.clear() : db.delete(ids);
-      return json14({ removed, total: db.total() });
+      return json15({ removed, total: db.total() });
     }
     if (url.pathname === "/api/ssh-pool") {
       const cfg = getConfig();
@@ -66614,7 +66792,7 @@ async function runDashboard(cfg, transportLabel) {
       const totalInflight = ps.reduce((s, p) => s + p.inflight, 0);
       const totalIdle = ps.filter((p) => p.idle).length;
       const totalBusy = ps.filter((p) => p.inflight > 0).length;
-      return json14({
+      return json15({
         enabled,
         config: {
           keepAlive: cfg.ssh.keepAlive,
@@ -66643,39 +66821,39 @@ async function runDashboard(cfg, transportLabel) {
       });
     }
     if (url.pathname === "/api/devices") {
-      return json14(devicesPayload(db));
+      return json15(devicesPayload(db));
     }
     if (url.pathname === "/api/capabilities") {
       const devices = Object.keys(getConfig().devices).map((name) => ({
         device: name,
         capabilities: serializeCapabilities(peekCapabilities(name))
       }));
-      return json14({ devices });
+      return json15({ devices });
     }
     if (url.pathname === "/api/capabilities/refresh" && req.method === "POST") {
       const b = await readJson(req);
       if (typeof b?.device !== "string")
-        return json14({ error: "device (string) is required" }, 400);
+        return json15({ error: "device (string) is required" }, 400);
       if (!(b.device in getConfig().devices)) {
-        return json14({ error: `unknown device: ${b.device}` }, 404);
+        return json15({ error: `unknown device: ${b.device}` }, 404);
       }
       invalidateCapabilities(b.device);
       try {
         const caps = await getCapabilities(b.device);
-        return json14({ device: b.device, capabilities: serializeCapabilities(caps) });
+        return json15({ device: b.device, capabilities: serializeCapabilities(caps) });
       } catch (e) {
         logger.error(`Capability probe failed for '${b.device}': ${logError(e)}`);
-        return json14({ error: clientError(e) }, 502);
+        return json15({ error: clientError(e) }, 502);
       }
     }
     if (url.pathname === "/api/devices/toggle" && req.method === "POST") {
       const b = await readJson(req);
       if (typeof b?.device !== "string" || typeof b?.disabled !== "boolean") {
-        return json14({ error: "device (string) and disabled (boolean) are required" }, 400);
+        return json15({ error: "device (string) and disabled (boolean) are required" }, 400);
       }
       const cfg = getConfig();
       if (!(b.device in cfg.devices))
-        return json14({ error: `unknown device: ${b.device}` }, 404);
+        return json15({ error: `unknown device: ${b.device}` }, 404);
       const dc = cfg.devices[b.device];
       const next = {
         ...cfg,
@@ -66696,7 +66874,7 @@ async function runDashboard(cfg, transportLabel) {
       if (persisted) {
         recordVersion(getConfig(), "auto", Date.now(), `device ${b.disabled ? "disabled" : "enabled"}: ${b.device}`);
       }
-      return json14({
+      return json15({
         ok: true,
         persisted,
         requiresReconnect: true,
@@ -66709,17 +66887,17 @@ async function runDashboard(cfg, transportLabel) {
       const name = typeof b?.device === "string" ? b.device : "";
       const cfg = getConfig();
       if (!(name in cfg.devices))
-        return json14({ error: `unknown device: ${name}` }, 404);
+        return json15({ error: `unknown device: ${name}` }, 404);
       if (url.pathname === "/api/devices/reconnect")
         closeDevice(name);
       const status = await probeDevice2(name, cfg.devices[name]);
-      return json14({ ok: true, status, ...devicesPayload(db) });
+      return json15({ ok: true, status, ...devicesPayload(db) });
     }
     if (url.pathname === "/api/topology") {
-      return json14(topologyPayload());
+      return json15(topologyPayload());
     }
     if (url.pathname === "/api/config") {
-      return json14(configPayload());
+      return json15(configPayload());
     }
     if (url.pathname === "/" || url.pathname === "/index.html") {
       return new Response(dashboardHtml(), {
@@ -66728,9 +66906,9 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases/latest") {
       try {
-        return json14(await fetchLatestRelease());
+        return json15(await fetchLatestRelease());
       } catch (e) {
-        return json14({ error: clientError(e, "fetch failed") }, 502);
+        return json15({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/catalog" && req.method === "GET") {
@@ -66749,7 +66927,7 @@ async function runDashboard(cfg, transportLabel) {
       }));
       const prompts = listPrompts();
       const groups = [...new Set(modules.map((m) => m.group))].sort();
-      return json14({
+      return json15({
         modules,
         prompts,
         groups,
@@ -66764,25 +66942,25 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/releases" && req.method === "GET") {
       try {
-        return json14(await fetchAllReleases());
+        return json15(await fetchAllReleases());
       } catch (e) {
-        return json14({ error: clientError(e, "fetch failed") }, 502);
+        return json15({ error: clientError(e, "fetch failed") }, 502);
       }
     }
     if (url.pathname === "/api/upgrade" && req.method === "POST") {
       const body = await readJson(req);
       const version = String(body?.version ?? "latest");
       if (version !== "latest" && !/^\d+\.\d+\.\d+$/.test(version)) {
-        return json14({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
+        return json15({ ok: false, error: `Invalid version "${version}" (use "latest" or x.y.z).` }, 400);
       }
       const spec = `@usex/mikrotik-mcp@${version}`;
       logger.warn(`Dashboard requested upgrade: bun i -g ${spec}`);
       const { ok, log } = await runUpgrade(spec);
       if (!ok)
-        return json14({ ok: false, version, log }, 500);
+        return json15({ ok: false, version, log }, 500);
       const willRestart = body?.restart !== false;
       const relaunched = willRestart ? restartProcess() : false;
-      return json14({
+      return json15({
         ok: true,
         version,
         log,
@@ -66792,7 +66970,7 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/meta") {
       const f = facets(db);
-      return json14({
+      return json15({
         ...f,
         version: VERSION,
         risks: ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"],
@@ -66803,19 +66981,19 @@ async function runDashboard(cfg, transportLabel) {
     }
     if (url.pathname === "/api/events") {
       const filter = filterFromQuery(url);
-      return json14({ events: db.query(filter), total: db.total() });
+      return json15({ events: db.query(filter), total: db.total() });
     }
     const eventMatch = url.pathname.match(/^\/api\/event\/(.+)$/);
     if (eventMatch) {
       const e = db.get(decodeURIComponent(eventMatch[1]));
-      return e ? json14(e) : json14({ error: "not found" }, 404);
+      return e ? json15(e) : json15({ error: "not found" }, 404);
     }
     if (url.pathname === "/api/stats") {
       const now = Date.now();
       const windowMs = Number(url.searchParams.get("window") ?? 3600000);
       const buckets = Number(url.searchParams.get("buckets") ?? 60);
       const events = db.query({ since: now - windowMs, limit: 5000 });
-      return json14(computeStats(events, { now, windowMs, buckets }));
+      return json15(computeStats(events, { now, windowMs, buckets }));
     }
     return new Response("Not Found", { status: 404 });
   }
@@ -66834,7 +67012,7 @@ async function runDashboard(cfg, transportLabel) {
         return await dashboardRoute(req, url, srv, configAdmin, transportLabel);
       } catch (e) {
         logger.error(`Dashboard request failed (${url.pathname}): ${logError(e)}`);
-        return json14({ error: clientError(e) }, 502);
+        return json15({ error: clientError(e) }, 502);
       }
     },
     websocket: {