mikromcp 1.0.10 → 1.2.0

package/dist/main.js

@@ -3,7 +3,7 @@
 // src/main.ts
 import { config as loadDotenv } from "dotenv";
 import { join as join5 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir4 } from "os";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -50,9 +50,8 @@ function loadAppConfig() {
       failureThreshold: 5,
       cooldownMs: 3e4
     },
-    pagination: {
-      defaultLimit: 100,
-      maxLimit: 500
+    retention: {
+      snapshotMaxAgeDays: parseInt(env.MIKROMCP_SNAPSHOT_RETENTION_DAYS ?? "30", 10)
     }
   };
 }
@@ -61,7 +60,7 @@ function loadAppConfig() {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/tool-registry.ts
-import { z as z32 } from "zod";
+import { z as z36 } from "zod";
 
 // src/domain/tools/system-tools.ts
 import { z } from "zod";
@@ -371,8 +370,8 @@ function buildTextSummary(sections) {
   if (sections.health) {
     const h = sections.health;
     lines.push(`Health:`);
-    for (const [key, value] of Object.entries(h)) {
-      if (key !== ".id") lines.push(`  ${key}: ${value}`);
+    for (const [key2, value] of Object.entries(h)) {
+      if (key2 !== ".id") lines.push(`  ${key2}: ${value}`);
     }
   }
   if (sections.clock) {
@@ -447,7 +446,12 @@ var COUNTER_PROPS = [
   "rx-drop",
   "tx-error",
   "rx-error",
-  "tx-queue-drop"
+  "tx-queue-drop",
+  "fp-tx-byte",
+  "fp-rx-byte",
+  "fp-tx-packet",
+  "fp-rx-packet",
+  "fp-rps-drop"
 ];
 var listInterfacesTool = {
   name: "list_interfaces",
@@ -491,14 +495,17 @@ var listInterfacesTool = {
       }
       const total = interfaces.length;
       const paginated = interfaces.slice(parsed.offset, parsed.offset + parsed.limit);
-      const results2 = parsed.includeCounters ? paginated : paginated.map((iface) => {
-        const cleaned = {};
-        for (const [key, value] of Object.entries(iface)) {
-          if (!COUNTER_PROPS.includes(key)) {
-            cleaned[key] = value;
+      const results2 = paginated.map((iface) => {
+        const rec = iface;
+        const isRunning = rec.running === true || rec.running === "true";
+        const isDisabled = rec.disabled === true || rec.disabled === "true";
+        const enriched = { status: isDisabled ? "disabled" : isRunning ? "up" : "down" };
+        for (const [key2, value] of Object.entries(rec)) {
+          if (parsed.includeCounters || !COUNTER_PROPS.includes(key2)) {
+            enriched[key2] = value;
           }
         }
-        return cleaned;
+        return enriched;
       });
       const hasMore = parsed.offset + parsed.limit < total;
       const lines = [
@@ -508,8 +515,8 @@ var listInterfacesTool = {
         const rec = iface;
         const name = rec.name ?? rec[".id"] ?? "unknown";
         const type = rec.type ?? parsed.type;
-        const running = rec.running === "true" ? "UP" : "DOWN";
-        lines.push(`  ${name} [${type}] ${running}`);
+        const status = String(rec.status).toUpperCase();
+        lines.push(`  ${name} [${type}] ${status}`);
       }
       return {
         content: lines.join("\n"),
@@ -527,115 +534,7 @@ var listInterfacesTool = {
     }
   }
 };
-var createVlanInputSchema = z2.object({
-  routerId: z2.string().describe("Target router identifier from the router registry"),
-  name: z2.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name (alphanumeric, hyphens, underscores, max 15 chars)"),
-  vlanId: z2.number().int().min(1).max(4094).describe("VLAN ID (1-4094)"),
-  parentInterface: z2.string().describe("Parent interface name (e.g., ether1, bridge1)"),
-  mtu: z2.number().int().min(68).max(9e3).default(1500).describe("MTU size"),
-  disabled: z2.boolean().default(false).describe("Whether the VLAN interface should be disabled"),
-  comment: z2.string().max(255).optional().describe("Optional comment for the VLAN interface"),
-  dryRun: z2.boolean().default(false).describe("If true, validate and return planned changes without applying")
-}).strict();
-function sanitizeComment(comment) {
-  if (comment === void 0) return void 0;
-  return comment.replace(/[\x00-\x1f\x7f]/g, "");
-}
-var createVlanTool = {
-  name: "create_vlan",
-  title: "Create VLAN Interface",
-  description: "Create a new VLAN interface on a MikroTik router. Performs idempotency checks: if a VLAN with the same name already exists with matching configuration, returns success without changes. Supports dry-run mode.",
-  inputSchema: createVlanInputSchema,
-  annotations: {
-    readOnlyHint: false,
-    destructiveHint: false,
-    idempotentHint: true,
-    openWorldHint: false
-  },
-  async handler(params, context) {
-    const parsed = createVlanInputSchema.parse(params);
-    const comment = sanitizeComment(parsed.comment);
-    log2.info(
-      { routerId: context.routerId, name: parsed.name, vlanId: parsed.vlanId },
-      "Creating VLAN interface"
-    );
-    try {
-      const existing = await context.routerClient.get("interface/vlan", {
-        filter: { name: parsed.name }
-      });
-      if (existing.length > 0) {
-        const found = existing[0];
-        const existingVlanId = found["vlan-id"];
-        const existingInterface = found.interface;
-        if (existingVlanId === String(parsed.vlanId) && existingInterface === parsed.parentInterface) {
-          log2.info({ name: parsed.name }, "VLAN already exists with matching config");
-          return {
-            content: `VLAN "${parsed.name}" already exists with VLAN ID ${parsed.vlanId} on ${parsed.parentInterface}. No changes made.`,
-            structuredContent: {
-              action: "already_exists",
-              vlan: found
-            }
-          };
-        }
-        throw new MikroMCPError({
-          category: "CONFLICT" /* CONFLICT */,
-          code: "VLAN_NAME_CONFLICT",
-          message: `VLAN "${parsed.name}" already exists but with different configuration (vlan-id=${existingVlanId}, interface=${existingInterface}). Expected vlan-id=${parsed.vlanId}, interface=${parsed.parentInterface}.`,
-          details: {
-            existingVlanId,
-            existingInterface,
-            requestedVlanId: parsed.vlanId,
-            requestedInterface: parsed.parentInterface
-          },
-          recoverability: {
-            retryable: false,
-            suggestedAction: "Use a different name or update the existing VLAN."
-          }
-        });
-      }
-      if (parsed.dryRun) {
-        const diff = [
-          { property: "name", before: null, after: parsed.name },
-          { property: "vlan-id", before: null, after: String(parsed.vlanId) },
-          { property: "interface", before: null, after: parsed.parentInterface },
-          { property: "mtu", before: null, after: String(parsed.mtu) },
-          { property: "disabled", before: null, after: parsed.disabled ? "true" : "false" },
-          ...comment ? [{ property: "comment", before: null, after: comment }] : []
-        ];
-        return {
-          content: `Dry run: Would create VLAN "${parsed.name}" (ID ${parsed.vlanId}) on ${parsed.parentInterface} with MTU ${parsed.mtu}.`,
-          structuredContent: {
-            action: "dry_run",
-            diff
-          }
-        };
-      }
-      const body = {
-        name: parsed.name,
-        "vlan-id": String(parsed.vlanId),
-        interface: parsed.parentInterface,
-        mtu: String(parsed.mtu),
-        disabled: parsed.disabled ? "true" : "false"
-      };
-      if (comment) {
-        body.comment = comment;
-      }
-      const created = await context.routerClient.create("interface/vlan", body);
-      log2.info({ name: parsed.name, id: created[".id"] }, "VLAN created successfully");
-      return {
-        content: `Created VLAN "${parsed.name}" (ID ${parsed.vlanId}) on ${parsed.parentInterface} with MTU ${parsed.mtu}.`,
-        structuredContent: {
-          action: "created",
-          vlan: created
-        }
-      };
-    } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "create_vlan" });
-    }
-  }
-};
-var interfaceTools = [listInterfacesTool, createVlanTool];
+var interfaceTools = [listInterfacesTool];
 
 // src/domain/tools/ip-tools.ts
 import { z as z4 } from "zod";
@@ -686,7 +585,7 @@ var inputSchema2 = z4.object({
   disabled: z4.boolean().default(false).describe("Whether the IP address should be disabled"),
   dryRun: z4.boolean().default(false).describe("If true, validate and return planned changes without applying")
 }).strict();
-function sanitizeComment2(comment) {
+function sanitizeComment(comment) {
   if (comment === void 0) return void 0;
   return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
@@ -710,7 +609,7 @@ var manageIpAddressTool = {
   snapshotPaths: ["ip/address"],
   async handler(params, context) {
     const parsed = inputSchema2.parse(params);
-    const comment = sanitizeComment2(parsed.comment);
+    const comment = sanitizeComment(parsed.comment);
     log3.info(
       {
         routerId: context.routerId,
@@ -899,13 +798,14 @@ var listDhcpLeasesInputSchema = z5.object({
   server: z5.string().optional().describe("Filter by DHCP server name"),
   status: z5.enum(["bound", "waiting", "offered", "blocked", "all"]).default("all").describe("Filter by lease status"),
   macAddress: z5.string().optional().describe("Filter by MAC address (exact match, case-insensitive)"),
+  leaseType: z5.enum(["dynamic", "static", "all"]).default("all").describe("Filter by lease type (dynamic or static)"),
   limit: z5.number().int().min(1).max(500).default(100).describe("Maximum number of leases to return"),
   offset: z5.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 var listDhcpLeasesTool = {
   name: "list_dhcp_leases",
   title: "List DHCP Leases",
-  description: "List DHCP leases on a MikroTik router with optional filtering by server, status, and MAC address. Supports pagination.",
+  description: "List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.",
   inputSchema: listDhcpLeasesInputSchema,
   annotations: {
     readOnlyHint: true,
@@ -949,6 +849,14 @@ var listDhcpLeasesTool = {
           return leaseMAC === upperMac;
         });
       }
+      if (parsed.leaseType !== "all") {
+        leases = leases.filter((lease) => {
+          const rec = lease;
+          const isDynamic = rec.dynamic === true || rec.dynamic === "true";
+          if (parsed.leaseType === "dynamic") return isDynamic;
+          return !isDynamic;
+        });
+      }
       const total = leases.length;
       const paginated = leases.slice(parsed.offset, parsed.offset + parsed.limit);
       const hasMore = parsed.offset + parsed.limit < total;
@@ -980,7 +888,110 @@ var listDhcpLeasesTool = {
     }
   }
 };
-var dhcpTools = [listDhcpLeasesTool];
+var manageDhcpLeaseInputSchema = z5.object({
+  routerId: z5.string().describe("Target router identifier from the router registry"),
+  action: z5.enum(["make-static", "remove"]).describe(
+    "Action to perform: make-static converts a dynamic lease to static; remove deletes the lease"
+  ),
+  macAddress: z5.string().describe("MAC address of the lease \u2014 idempotency key (case-insensitive)"),
+  dryRun: z5.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageDhcpLeaseTool = {
+  name: "manage_dhcp_lease",
+  title: "Manage DHCP Lease",
+  description: "Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.",
+  inputSchema: manageDhcpLeaseInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["ip/dhcp-server/lease"],
+  async handler(params, context) {
+    const parsed = manageDhcpLeaseInputSchema.parse(params);
+    const upperMac = parsed.macAddress.toUpperCase();
+    log4.info(
+      { routerId: context.routerId, action: parsed.action, macAddress: upperMac },
+      "Managing DHCP lease"
+    );
+    try {
+      const allLeases = await context.routerClient.get("ip/dhcp-server/lease", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allLeases.find(
+        (l) => (l["mac-address"] ?? "").toUpperCase() === upperMac
+      );
+      if (parsed.action === "make-static") {
+        if (!existing) {
+          throw new MikroMCPError({
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "DHCP_LEASE_NOT_FOUND",
+            message: `No DHCP lease found for MAC address ${upperMac}.`,
+            details: { macAddress: upperMac },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify the MAC address with list_dhcp_leases.",
+              alternativeTools: ["list_dhcp_leases"]
+            }
+          });
+        }
+        const existingDynamic = existing.dynamic;
+        const isAlreadyStatic = existingDynamic === "false" || existingDynamic === false;
+        if (isAlreadyStatic) {
+          return {
+            content: `Lease for ${upperMac} (${existing.address ?? "unknown"}) is already static. No changes made.`,
+            structuredContent: { action: "already_static", macAddress: upperMac, id: existing[".id"] }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would convert lease for ${upperMac} (${existing.address ?? "unknown"}) to static.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "dynamic", before: "true", after: "false" }],
+              lease: existing
+            }
+          };
+        }
+        await context.routerClient.update("ip/dhcp-server/lease", existing[".id"], {
+          dynamic: "false"
+        });
+        log4.info({ macAddress: upperMac, id: existing[".id"] }, "DHCP lease converted to static");
+        return {
+          content: `Lease for ${upperMac} (${existing.address ?? "unknown"}) converted to static.`,
+          structuredContent: { action: "made-static", macAddress: upperMac, id: existing[".id"] }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `No DHCP lease found for MAC address ${upperMac}. Nothing to remove.`,
+          structuredContent: { action: "not_found", macAddress: upperMac }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove lease for ${upperMac}.`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "mac-address", before: upperMac, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove("ip/dhcp-server/lease", existing[".id"]);
+      log4.info({ macAddress: upperMac }, "DHCP lease removed");
+      return {
+        content: `Removed DHCP lease for ${upperMac}.`,
+        structuredContent: { action: "removed", macAddress: upperMac, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_lease" });
+    }
+  }
+};
+var dhcpTools = [listDhcpLeasesTool, manageDhcpLeaseTool];
 
 // src/domain/tools/route-tools.ts
 import { z as z6 } from "zod";
@@ -1084,7 +1095,7 @@ var manageRouteInputSchema = z6.object({
   disabled: z6.boolean().default(false).describe("Whether the route should be disabled"),
   dryRun: z6.boolean().default(false).describe("If true, validate and return planned changes without applying")
 }).strict();
-function sanitizeComment3(comment) {
+function sanitizeComment2(comment) {
   if (comment === void 0) return void 0;
   return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
@@ -1112,7 +1123,7 @@ var manageRouteTool = {
   snapshotPaths: ["ip/route"],
   async handler(params, context) {
     const parsed = manageRouteInputSchema.parse(params);
-    const comment = sanitizeComment3(parsed.comment);
+    const comment = sanitizeComment2(parsed.comment);
     log5.info(
       {
         routerId: context.routerId,
@@ -1253,7 +1264,7 @@ var log6 = createLogger("firewall-tools");
 function tableToPath(table) {
   return table === "filter" ? "ip/firewall/filter" : "ip/firewall/nat";
 }
-function sanitizeComment4(comment) {
+function sanitizeComment3(comment) {
   if (comment === void 0) return void 0;
   return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
@@ -1392,7 +1403,7 @@ var manageFirewallRuleTool = {
   snapshotPaths: ["ip/firewall/filter", "ip/firewall/nat"],
   async handler(params, context) {
     const parsed = manageFirewallRuleInputSchema.parse(params);
-    const comment = sanitizeComment4(parsed.comment);
+    const comment = sanitizeComment3(parsed.comment);
     log6.info(
       {
         routerId: context.routerId,
@@ -2112,8 +2123,8 @@ var runCommandTool = {
   async handler(params, context) {
     const parsed = runCommandInputSchema.parse(params);
     log8.info({ routerId: context.routerId, command: parsed.command }, "Running command");
-    const globalAllow = (process.env.MIKROMCP_CMD_ALLOW ?? "").split(",").map((s) => s.trim()).filter(Boolean);
-    const globalDeny = (process.env.MIKROMCP_CMD_DENY ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+    const globalAllow = context.appConfig.cmdAllow;
+    const globalDeny = context.appConfig.cmdDeny;
     const policy = resolveCommandPolicy(context.routerConfig, globalAllow, globalDeny);
     checkCommand(parsed.command, policy);
     if (parsed.dryRun) {
@@ -2711,9 +2722,9 @@ var listPeersTool = {
       const lines = [`WireGuard peers on ${context.routerId}: ${total} total`];
       for (const peer of peers) {
         const rec = peer;
-        const key = rec["public-key"] ? rec["public-key"].slice(0, 8) + "\u2026" : "unknown";
+        const key2 = rec["public-key"] ? rec["public-key"].slice(0, 8) + "\u2026" : "unknown";
         lines.push(
-          `  [${rec.interface ?? "?"}] ${key} last-handshake=${rec["last-handshake"] ?? "never"}`
+          `  [${rec.interface ?? "?"}] ${key2} last-handshake=${rec["last-handshake"] ?? "never"}`
         );
       }
       return {
@@ -4905,12 +4916,10 @@ var containerTools = [listContainersTool, manageContainerTool];
 
 // src/domain/tools/change-management-tools.ts
 import { z as z23 } from "zod";
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync } from "fs";
 
 // src/domain/snapshot/snapshot-engine.ts
-import { mkdirSync, writeFileSync, readFileSync } from "fs";
+import { mkdir, writeFile, readFile } from "fs/promises";
 import { join as join2 } from "path";
 import { nanoid } from "nanoid";
 function pathToSlug(rosPath) {
@@ -4925,13 +4934,13 @@ async function takeSnapshot(client, routerId, path, snapshotDir) {
   const dir = join2(snapshotDir, routerId);
   const filePath = join2(dir, `${id}.json`);
   const ts = (/* @__PURE__ */ new Date()).toISOString();
-  mkdirSync(dir, { recursive: true });
+  await mkdir(dir, { recursive: true });
   const stored = { id, routerId, path, ts, records };
-  writeFileSync(filePath, JSON.stringify(stored, null, 2));
+  await writeFile(filePath, JSON.stringify(stored, null, 2));
   return { id, routerId, path, ts, filePath, recordCount: records.length };
 }
-function loadSnapshot(filePath) {
-  return JSON.parse(readFileSync(filePath, "utf-8"));
+async function loadSnapshot(filePath) {
+  return JSON.parse(await readFile(filePath, "utf-8"));
 }
 
 // src/domain/snapshot/diff-engine.ts
@@ -4951,7 +4960,16 @@ var SEMANTIC_KEYS = {
   "system/scheduler": ["name"],
   "system/script": ["name"],
   "system/package": ["name"],
-  "container": ["name"]
+  "container": ["name"],
+  "certificate": ["name"],
+  "file": ["name"],
+  "interface/vrrp": ["name"],
+  "ip/dhcp-server": ["name"],
+  "ip/ipsec/peer": ["name"],
+  "ip/pool": ["name"],
+  "queue/simple": ["name"],
+  "tool/netwatch": ["host"],
+  "user": ["name"]
 };
 function normalizeValue(v) {
   if (v === "true" || v === "yes") return "true";
@@ -4986,8 +5004,8 @@ function computeRestorePlan(path, before, current) {
   const beforeByKey = new Map(before.map((r) => [semanticKey(r, keys), r]));
   const toCreate = [];
   const toUpdate = [];
-  for (const [key, beforeRecord] of beforeByKey) {
-    const currentRecord = currentByKey.get(key);
+  for (const [key2, beforeRecord] of beforeByKey) {
+    const currentRecord = currentByKey.get(key2);
     if (!currentRecord) {
       toCreate.push(beforeRecord);
     } else if (!recordsAreEqual(beforeRecord, currentRecord)) {
@@ -5012,52 +5030,63 @@ async function applyRestorePlan(plan, client) {
 }
 
 // src/domain/snapshot/write-journal.ts
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { appendFile as appendFile2, mkdir as mkdir2 } from "fs/promises";
 import { dirname } from "path";
 import { nanoid as nanoid2 } from "nanoid";
 
 // src/observability/audit-log.ts
-import { appendFileSync } from "fs";
+import { appendFile } from "fs/promises";
 var log22 = createLogger("audit");
-var SENSITIVE_KEYS = /* @__PURE__ */ new Set(["password", "token", "secret", "authorization", "credentials"]);
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "pass",
+  "token",
+  "secret",
+  "authorization",
+  "credentials",
+  "privatekey",
+  "presharedkey",
+  "psk",
+  "passphrase",
+  "community",
+  "apikey",
+  "confirmationsecret"
+]);
 function redactParams(params) {
   const out = {};
-  for (const [key, value] of Object.entries(params)) {
-    if (SENSITIVE_KEYS.has(key)) continue;
+  for (const [key2, value] of Object.entries(params)) {
+    if (SENSITIVE_KEYS.has(key2.toLowerCase())) continue;
     if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      out[key] = redactParams(value);
+      out[key2] = redactParams(value);
     } else {
-      out[key] = value;
+      out[key2] = value;
     }
   }
   return out;
 }
-var auditFilePath = process.env.MIKROMCP_AUDIT_LOG_PATH || void 0;
-function auditLog(event) {
+function auditLog(event, auditLogPath) {
   const safeEvent = { ...event, params: redactParams(event.params) };
   log22.info(safeEvent, "audit");
-  if (auditFilePath) {
-    try {
-      appendFileSync(auditFilePath, JSON.stringify(safeEvent) + "\n");
-    } catch (err) {
-      log22.error({ err, auditFilePath }, "Failed to write audit event to file");
-    }
+  if (auditLogPath) {
+    appendFile(auditLogPath, JSON.stringify(safeEvent) + "\n").catch((err) => {
+      log22.error({ err, auditLogPath }, "Failed to write audit event to file");
+    });
   }
 }
 
 // src/domain/snapshot/write-journal.ts
 var log23 = createLogger("write-journal");
-function appendLine(filePath, obj) {
+async function appendLine(filePath, obj) {
   try {
-    mkdirSync2(dirname(filePath), { recursive: true });
-    appendFileSync2(filePath, JSON.stringify(obj) + "\n");
+    await mkdir2(dirname(filePath), { recursive: true });
+    await appendFile2(filePath, JSON.stringify(obj) + "\n");
   } catch (err) {
     log23.error({ err, filePath }, "Failed to write to write journal");
   }
 }
 function recordAttempt(args) {
   const id = nanoid2();
-  appendLine(args.journalPath, {
+  void appendLine(args.journalPath, {
     id,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     identityId: args.identityId,
@@ -5071,7 +5100,7 @@ function recordAttempt(args) {
   return id;
 }
 function recordOutcome(args) {
-  appendLine(args.journalPath, {
+  void appendLine(args.journalPath, {
     id: args.journalId,
     ts: (/* @__PURE__ */ new Date()).toISOString(),
     phase: args.phase,
@@ -5185,9 +5214,8 @@ function createChangeManagementTools(baseTools2) {
     async handler(params, context) {
       const parsed = applyPlanInputSchema.parse(params);
       log24.info({ routerId: context.routerId, stepCount: parsed.steps.length }, "Applying plan");
-      const dataDir = process.env.MIKROMCP_DATA_DIR ?? join3(homedir2(), ".mikromcp", "data");
-      const journalPath = `${dataDir}/write-journal.ndjson`;
-      const snapshotDir = `${dataDir}/snapshots`;
+      const journalPath = context.appConfig.journalPath;
+      const snapshotDir = context.appConfig.snapshotDir;
       const results2 = [];
       for (const [i, step] of parsed.steps.entries()) {
         const tool = requireTool(step.tool);
@@ -5212,9 +5240,11 @@ function createChangeManagementTools(baseTools2) {
           params: stepParams,
           snapshotIds
         });
+        const stepStartMs = Date.now();
         try {
-          const result = await tool.handler(stepParams, context);
-          recordOutcome({ journalPath, journalId: stepJournalId, phase: "success", durationMs: 0 });
+          const runStep = () => tool.handler(stepParams, context);
+          const result = context.circuitBreaker ? await context.circuitBreaker.execute(runStep) : await runStep();
+          recordOutcome({ journalPath, journalId: stepJournalId, phase: "success", durationMs: Date.now() - stepStartMs });
           results2.push({
             stepIndex: i,
             tool: step.tool,
@@ -5224,7 +5254,7 @@ function createChangeManagementTools(baseTools2) {
           });
         } catch (err) {
           const error = err instanceof MikroMCPError ? err : enrichError(err, { tool: step.tool });
-          recordOutcome({ journalPath, journalId: stepJournalId, phase: "failure", outcome: error.code, durationMs: 0 });
+          recordOutcome({ journalPath, journalId: stepJournalId, phase: "failure", outcome: error.code, durationMs: Date.now() - stepStartMs });
           log24.error({ err: error, tool: step.tool, step: i }, "apply_plan step failed");
           return {
             content: `Apply failed at step ${i + 1}/${parsed.steps.length} (${step.tool}): ${error.message}. ${i} step(s) completed before failure.`,
@@ -5250,7 +5280,7 @@ function createChangeManagementTools(baseTools2) {
     }
   };
   function findJournalEntry(journalPath, journalId) {
-    const raw = readFileSync2(journalPath, "utf-8");
+    const raw = readFileSync(journalPath, "utf-8");
     const lines = raw.split("\n").filter(Boolean);
     const entry = lines.map((l) => JSON.parse(l)).find((e) => e.id === journalId && e.phase === "attempt");
     if (!entry) {
@@ -5279,9 +5309,8 @@ function createChangeManagementTools(baseTools2) {
     },
     async handler(params, context) {
       const parsed = rollbackChangeInputSchema.parse(params);
-      const dataDir = process.env.MIKROMCP_DATA_DIR ?? join3(homedir2(), ".mikromcp", "data");
-      const journalPath = `${dataDir}/write-journal.ndjson`;
-      const snapshotDir = `${dataDir}/snapshots`;
+      const journalPath = context.appConfig.journalPath;
+      const snapshotDir = context.appConfig.snapshotDir;
       log24.info({ routerId: context.routerId, journalId: parsed.journalId }, "Rolling back change");
       const { snapshotIds } = findJournalEntry(journalPath, parsed.journalId);
       if (snapshotIds.length === 0) {
@@ -5293,7 +5322,7 @@ function createChangeManagementTools(baseTools2) {
       const restorePlans = [];
       for (const snapshotId of snapshotIds) {
         const filePath = `${snapshotDir}/${context.routerId}/${snapshotId}.json`;
-        const stored = loadSnapshot(filePath);
+        const stored = await loadSnapshot(filePath);
         const current = await context.routerClient.get(stored.path, {});
         const plan = computeRestorePlan(stored.path, stored.records, current);
         restorePlans.push(plan);
@@ -6034,7 +6063,8 @@ var log28 = createLogger("dhcp-server-tools");
 var listDhcpServersInputSchema = z27.object({
   routerId: z27.string().describe("Target router identifier from the router registry"),
   interface: z27.string().optional().describe("Filter by interface name (exact match)"),
-  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of DHCP servers to return")
+  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of DHCP servers to return"),
+  offset: z27.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 var listDhcpServersTool = {
   name: "list_dhcp_servers",
@@ -6055,17 +6085,19 @@ var listDhcpServersTool = {
         limit: void 0,
         offset: void 0
       });
-      const filtered = parsed.interface ? allServers.filter(
-        (s) => s.interface === parsed.interface
-      ) : allServers;
-      const servers = filtered.slice(0, parsed.limit);
+      let filtered = parsed.interface ? allServers.filter((s) => s.interface === parsed.interface) : allServers;
+      const total = filtered.length;
+      const servers = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
       return {
-        content: `DHCP servers on ${context.routerId}: ${servers.length} returned (${allServers.length} total)`,
+        content: `DHCP servers on ${context.routerId}: ${total} total, showing ${servers.length} (offset ${parsed.offset})`,
         structuredContent: {
           routerId: context.routerId,
           servers,
-          total: allServers.length,
-          returned: servers.length
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
         }
       };
     } catch (err) {
@@ -6256,16 +6288,22 @@ var manageDhcpServerTool = {
     }
   }
 };
-var listDhcpPoolsInputSchema = z27.object({
-  routerId: z27.string().describe("Target router identifier from the router registry"),
-  name: z27.string().optional().describe("Filter by pool name (substring match)"),
-  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of pools to return")
+var dhcpServerTools = [listDhcpServersTool, manageDhcpServerTool];
+
+// src/domain/tools/ip-pool-tools.ts
+import { z as z28 } from "zod";
+var log29 = createLogger("ip-pool-tools");
+var listIpPoolsInputSchema = z28.object({
+  routerId: z28.string().describe("Target router identifier from the router registry"),
+  name: z28.string().optional().describe("Filter by pool name (substring match)"),
+  limit: z28.number().int().min(1).max(500).default(100).describe("Maximum number of pools to return"),
+  offset: z28.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
-var listDhcpPoolsTool = {
-  name: "list_dhcp_pools",
-  title: "List DHCP Pools",
-  description: "List IP pools on a MikroTik router.",
-  inputSchema: listDhcpPoolsInputSchema,
+var listIpPoolsTool = {
+  name: "list_ip_pools",
+  title: "List IP Pools",
+  description: "List IP address pools on a MikroTik router. Supports filtering by name and pagination.",
+  inputSchema: listIpPoolsInputSchema,
   annotations: {
     readOnlyHint: true,
     destructiveHint: false,
@@ -6273,44 +6311,49 @@ var listDhcpPoolsTool = {
     openWorldHint: false
   },
   async handler(params, context) {
-    const parsed = listDhcpPoolsInputSchema.parse(params);
-    log28.info({ routerId: context.routerId }, "Listing DHCP pools");
+    const parsed = listIpPoolsInputSchema.parse(params);
+    log29.info({ routerId: context.routerId }, "Listing IP pools");
     try {
       const allPools = await context.routerClient.get("ip/pool", {
         limit: void 0,
         offset: void 0
       });
-      const filtered = parsed.name ? allPools.filter(
-        (p) => (p.name ?? "").includes(parsed.name)
-      ) : allPools;
-      const pools = filtered.slice(0, parsed.limit);
+      let filtered = allPools;
+      if (parsed.name) {
+        filtered = filtered.filter((p) => (p.name ?? "").includes(parsed.name));
+      }
+      const total = filtered.length;
+      const pools = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
       return {
-        content: `DHCP pools on ${context.routerId}: ${pools.length} returned (${allPools.length} total)`,
+        content: `IP pools on ${context.routerId}: ${total} total, showing ${pools.length} (offset ${parsed.offset})`,
         structuredContent: {
           routerId: context.routerId,
           pools,
-          total: allPools.length,
-          returned: pools.length
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_pools" });
+      throw enrichError(err, { routerId: context.routerId, tool: "list_ip_pools" });
     }
   }
 };
-var manageDhcpPoolInputSchema = z27.object({
-  routerId: z27.string().describe("Target router identifier from the router registry"),
-  action: z27.enum(["add", "remove"]).describe("Action to perform"),
-  name: z27.string().describe("Pool name \u2014 idempotency key"),
-  ranges: z27.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
-  nextPool: z27.string().optional().describe("Next pool name for overflow"),
-  dryRun: z27.boolean().default(false).describe("Preview changes without applying")
+var manageIpPoolInputSchema = z28.object({
+  routerId: z28.string().describe("Target router identifier from the router registry"),
+  action: z28.enum(["add", "remove"]).describe("Action to perform"),
+  name: z28.string().describe("Pool name \u2014 idempotency key"),
+  ranges: z28.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
+  nextPool: z28.string().optional().describe("Next pool name for overflow"),
+  dryRun: z28.boolean().default(false).describe("Preview changes without applying")
 }).strict();
-var manageDhcpPoolTool = {
-  name: "manage_dhcp_pool",
-  title: "Manage DHCP Pool",
-  description: "Add or remove an IP pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.",
-  inputSchema: manageDhcpPoolInputSchema,
+var manageIpPoolTool = {
+  name: "manage_ip_pool",
+  title: "Manage IP Pool",
+  description: "Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.",
+  inputSchema: manageIpPoolInputSchema,
   annotations: {
     readOnlyHint: false,
     destructiveHint: false,
@@ -6319,25 +6362,20 @@ var manageDhcpPoolTool = {
   },
   snapshotPaths: ["ip/pool"],
   async handler(params, context) {
-    const parsed = manageDhcpPoolInputSchema.parse(params);
-    log28.info(
-      { routerId: context.routerId, action: parsed.action, name: parsed.name },
-      "Managing DHCP pool"
-    );
+    const parsed = manageIpPoolInputSchema.parse(params);
+    log29.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP pool");
     try {
       const allPools = await context.routerClient.get("ip/pool", {
         limit: void 0,
         offset: void 0
       });
-      const existing = allPools.find(
-        (p) => p.name === parsed.name
-      );
+      const existing = allPools.find((p) => p.name === parsed.name);
       if (parsed.action === "add") {
         if (!parsed.ranges) {
           throw new MikroMCPError({
             category: "VALIDATION" /* VALIDATION */,
-            code: "DHCP_POOL_RANGES_REQUIRED",
-            message: "ranges is required when adding a DHCP pool.",
+            code: "IP_POOL_RANGES_REQUIRED",
+            message: "ranges is required when adding an IP pool.",
             details: { name: parsed.name },
             recoverability: {
               retryable: false,
@@ -6348,22 +6386,19 @@ var manageDhcpPoolTool = {
         if (existing) {
           if (existing.ranges === parsed.ranges) {
             return {
-              content: `DHCP pool "${parsed.name}" already exists with the same ranges. No changes made.`,
+              content: `IP pool "${parsed.name}" already exists with the same ranges. No changes made.`,
               structuredContent: { action: "already_exists", pool: existing }
             };
           }
           throw new MikroMCPError({
             category: "CONFLICT" /* CONFLICT */,
-            code: "DHCP_POOL_CONFLICT",
-            message: `DHCP pool "${parsed.name}" exists with different ranges.`,
-            details: {
-              existing: existing.ranges,
-              requested: parsed.ranges
-            },
+            code: "IP_POOL_CONFLICT",
+            message: `IP pool "${parsed.name}" exists with different ranges.`,
+            details: { existing: existing.ranges, requested: parsed.ranges },
             recoverability: {
               retryable: false,
               suggestedAction: "Remove the existing pool first or use a different name.",
-              alternativeTools: ["manage_dhcp_pool"]
+              alternativeTools: ["manage_ip_pool"]
             }
           });
         }
@@ -6374,63 +6409,52 @@ var manageDhcpPoolTool = {
             ...parsed.nextPool ? [{ property: "next-pool", before: null, after: parsed.nextPool }] : []
           ];
           return {
-            content: `Dry run: Would add DHCP pool "${parsed.name}".`,
+            content: `Dry run: Would add IP pool "${parsed.name}" with ranges ${parsed.ranges}.`,
             structuredContent: { action: "dry_run", diff }
           };
         }
-        const body = {
-          name: parsed.name,
-          ranges: parsed.ranges
-        };
+        const body = { name: parsed.name, ranges: parsed.ranges };
         if (parsed.nextPool) body["next-pool"] = parsed.nextPool;
         const created = await context.routerClient.create("ip/pool", body);
-        log28.info({ name: parsed.name, id: created[".id"] }, "DHCP pool added");
+        log29.info({ name: parsed.name, id: created[".id"] }, "IP pool added");
         return {
-          content: `Added DHCP pool "${parsed.name}".`,
+          content: `Added IP pool "${parsed.name}" with ranges ${parsed.ranges}.`,
           structuredContent: { action: "created", pool: created }
         };
       }
       if (!existing) {
         return {
-          content: `DHCP pool "${parsed.name}" not found. Nothing to remove.`,
+          content: `IP pool "${parsed.name}" not found. Nothing to remove.`,
           structuredContent: { action: "not_found", name: parsed.name }
         };
       }
       if (parsed.dryRun) {
         return {
-          content: `Dry run: Would remove DHCP pool "${parsed.name}".`,
-          structuredContent: {
-            action: "dry_run",
-            diff: [{ property: "name", before: parsed.name, after: null }]
-          }
+          content: `Dry run: Would remove IP pool "${parsed.name}".`,
+          structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
         };
       }
       await context.routerClient.remove("ip/pool", existing[".id"]);
-      log28.info({ name: parsed.name }, "DHCP pool removed");
+      log29.info({ name: parsed.name }, "IP pool removed");
       return {
-        content: `Removed DHCP pool "${parsed.name}".`,
+        content: `Removed IP pool "${parsed.name}".`,
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
       if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_pool" });
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ip_pool" });
     }
   }
 };
-var dhcpServerTools = [
-  listDhcpServersTool,
-  manageDhcpServerTool,
-  listDhcpPoolsTool,
-  manageDhcpPoolTool
-];
+var ipPoolTools = [listIpPoolsTool, manageIpPoolTool];
 
 // src/domain/tools/queue-tools.ts
-import { z as z28 } from "zod";
-var log29 = createLogger("queue-tools");
-var listQueuesInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  target: z28.string().optional().describe("Filter by target address (substring match)"),
-  limit: z28.number().int().min(1).max(500).default(100).describe("Maximum number of queues to return")
+import { z as z29 } from "zod";
+var log30 = createLogger("queue-tools");
+var listQueuesInputSchema = z29.object({
+  routerId: z29.string().describe("Target router identifier from the router registry"),
+  target: z29.string().optional().describe("Filter by target address (substring match)"),
+  limit: z29.number().int().min(1).max(500).default(100).describe("Maximum number of queues to return")
 }).strict();
 var listQueuesTool = {
   name: "list_queues",
@@ -6445,7 +6469,7 @@ var listQueuesTool = {
   },
   async handler(params, context) {
     const parsed = listQueuesInputSchema.parse(params);
-    log29.info({ routerId: context.routerId }, "Listing queues");
+    log30.info({ routerId: context.routerId }, "Listing queues");
     try {
       const allQueues = await context.routerClient.get("queue/simple", {
         limit: void 0,
@@ -6469,15 +6493,15 @@ var listQueuesTool = {
     }
   }
 };
-var manageQueueInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  action: z28.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z28.string().describe("Queue name \u2014 idempotency key"),
-  target: z28.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
-  maxLimit: z28.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
-  limitAt: z28.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
-  comment: z28.string().optional().describe("Optional comment"),
-  dryRun: z28.boolean().default(false).describe("Preview changes without applying")
+var manageQueueInputSchema = z29.object({
+  routerId: z29.string().describe("Target router identifier from the router registry"),
+  action: z29.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z29.string().describe("Queue name \u2014 idempotency key"),
+  target: z29.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
+  maxLimit: z29.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
+  limitAt: z29.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
+  comment: z29.string().optional().describe("Optional comment"),
+  dryRun: z29.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageQueueTool = {
   name: "manage_queue",
@@ -6493,7 +6517,7 @@ var manageQueueTool = {
   snapshotPaths: ["queue/simple"],
   async handler(params, context) {
     const parsed = manageQueueInputSchema.parse(params);
-    log29.info(
+    log30.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
       "Managing queue"
     );
@@ -6555,7 +6579,7 @@ var manageQueueTool = {
         if (parsed.limitAt) body["limit-at"] = parsed.limitAt;
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("queue/simple", body);
-        log29.info({ name: parsed.name, id: created[".id"] }, "Queue added");
+        log30.info({ name: parsed.name, id: created[".id"] }, "Queue added");
         return {
           content: `Added queue "${parsed.name}".`,
           structuredContent: { action: "created", queue: created }
@@ -6578,7 +6602,7 @@ var manageQueueTool = {
           };
         }
         await context.routerClient.remove("queue/simple", existing[".id"]);
-        log29.info({ name: parsed.name }, "Queue removed");
+        log30.info({ name: parsed.name }, "Queue removed");
         return {
           content: `Removed queue "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6617,7 +6641,7 @@ var manageQueueTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log29.info({ name: parsed.name, action: resultAction }, "Queue updated");
+      log30.info({ name: parsed.name, action: resultAction }, "Queue updated");
       return {
         content: `Queue "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -6631,12 +6655,12 @@ var manageQueueTool = {
 var queueTools = [listQueuesTool, manageQueueTool];
 
 // src/domain/tools/vrrp-tools.ts
-import { z as z29 } from "zod";
-var log30 = createLogger("vrrp-tools");
-var listVrrpInstancesInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  interface: z29.string().optional().describe("Filter by master interface name (exact match)"),
-  limit: z29.number().int().min(1).max(500).default(100).describe("Maximum number of instances to return")
+import { z as z30 } from "zod";
+var log31 = createLogger("vrrp-tools");
+var listVrrpInstancesInputSchema = z30.object({
+  routerId: z30.string().describe("Target router identifier from the router registry"),
+  interface: z30.string().optional().describe("Filter by master interface name (exact match)"),
+  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of instances to return")
 }).strict();
 var listVrrpInstancesTool = {
   name: "list_vrrp_instances",
@@ -6651,7 +6675,7 @@ var listVrrpInstancesTool = {
   },
   async handler(params, context) {
     const parsed = listVrrpInstancesInputSchema.parse(params);
-    log30.info({ routerId: context.routerId }, "Listing VRRP instances");
+    log31.info({ routerId: context.routerId }, "Listing VRRP instances");
     try {
       const allInstances = await context.routerClient.get("interface/vrrp", {
         limit: void 0,
@@ -6675,17 +6699,17 @@ var listVrrpInstancesTool = {
     }
   }
 };
-var manageVrrpInstanceInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  action: z29.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z29.string().describe("VRRP interface name \u2014 idempotency key"),
-  interface: z29.string().optional().describe("Master interface (required for add)"),
-  vrid: z29.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
-  priority: z29.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
-  interval: z29.number().int().min(1).optional().describe("Advertisement interval in seconds"),
-  version: z29.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
-  comment: z29.string().optional().describe("Optional comment"),
-  dryRun: z29.boolean().default(false).describe("Preview changes without applying")
+var manageVrrpInstanceInputSchema = z30.object({
+  routerId: z30.string().describe("Target router identifier from the router registry"),
+  action: z30.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z30.string().describe("VRRP interface name \u2014 idempotency key"),
+  interface: z30.string().optional().describe("Master interface (required for add)"),
+  vrid: z30.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
+  priority: z30.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
+  interval: z30.number().int().min(1).optional().describe("Advertisement interval in seconds"),
+  version: z30.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
+  comment: z30.string().optional().describe("Optional comment"),
+  dryRun: z30.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageVrrpInstanceTool = {
   name: "manage_vrrp_instance",
@@ -6701,7 +6725,7 @@ var manageVrrpInstanceTool = {
   snapshotPaths: ["interface/vrrp"],
   async handler(params, context) {
     const parsed = manageVrrpInstanceInputSchema.parse(params);
-    log30.info(
+    log31.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
       "Managing VRRP instance"
     );
@@ -6785,7 +6809,7 @@ var manageVrrpInstanceTool = {
         if (parsed.interval) body.interval = String(parsed.interval);
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("interface/vrrp", body);
-        log30.info({ name: parsed.name, id: created[".id"] }, "VRRP instance added");
+        log31.info({ name: parsed.name, id: created[".id"] }, "VRRP instance added");
         return {
           content: `Added VRRP instance "${parsed.name}".`,
           structuredContent: { action: "created", instance: created }
@@ -6808,7 +6832,7 @@ var manageVrrpInstanceTool = {
           };
         }
         await context.routerClient.remove("interface/vrrp", existing[".id"]);
-        log30.info({ name: parsed.name }, "VRRP instance removed");
+        log31.info({ name: parsed.name }, "VRRP instance removed");
         return {
           content: `Removed VRRP instance "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6847,7 +6871,7 @@ var manageVrrpInstanceTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log30.info({ name: parsed.name, action: resultAction }, "VRRP instance updated");
+      log31.info({ name: parsed.name, action: resultAction }, "VRRP instance updated");
       return {
         content: `VRRP instance "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -6861,10 +6885,10 @@ var manageVrrpInstanceTool = {
 var vrrpTools = [listVrrpInstancesTool, manageVrrpInstanceTool];
 
 // src/domain/tools/network-services-tools.ts
-import { z as z30 } from "zod";
-var log31 = createLogger("network-services-tools");
-var getSnmpSettingsInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry")
+import { z as z31 } from "zod";
+var log32 = createLogger("network-services-tools");
+var getSnmpSettingsInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry")
 }).strict();
 var getSnmpSettingsTool = {
   name: "get_snmp_settings",
@@ -6879,7 +6903,7 @@ var getSnmpSettingsTool = {
   },
   async handler(params, context) {
     const parsed = getSnmpSettingsInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Fetching SNMP settings");
+    log32.info({ routerId: context.routerId }, "Fetching SNMP settings");
     try {
       const results2 = await context.routerClient.get("snmp");
       if (!results2 || results2.length === 0) {
@@ -6908,8 +6932,8 @@ var getSnmpSettingsTool = {
     }
   }
 };
-var getNtpSettingsInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry")
+var getNtpSettingsInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry")
 }).strict();
 var getNtpSettingsTool = {
   name: "get_ntp_settings",
@@ -6924,7 +6948,7 @@ var getNtpSettingsTool = {
   },
   async handler(params, context) {
     const parsed = getNtpSettingsInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Fetching NTP settings");
+    log32.info({ routerId: context.routerId }, "Fetching NTP settings");
     try {
       const results2 = await context.routerClient.get("system/ntp/client");
       if (!results2 || results2.length === 0) {
@@ -6953,11 +6977,11 @@ var getNtpSettingsTool = {
     }
   }
 };
-var listNetwatchEntriesInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  host: z30.string().optional().describe("Filter by host (substring match)"),
-  status: z30.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
-  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return")
+var listNetwatchEntriesInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  host: z31.string().optional().describe("Filter by host (substring match)"),
+  status: z31.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
+  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return")
 }).strict();
 var listNetwatchEntriesTool = {
   name: "list_netwatch_entries",
@@ -6972,7 +6996,7 @@ var listNetwatchEntriesTool = {
   },
   async handler(params, context) {
     const parsed = listNetwatchEntriesInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Listing Netwatch entries");
+    log32.info({ routerId: context.routerId }, "Listing Netwatch entries");
     try {
       const allEntries = await context.routerClient.get("tool/netwatch", {
         limit: void 0,
@@ -6994,15 +7018,15 @@ var listNetwatchEntriesTool = {
     }
   }
 };
-var manageNetwatchEntryInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  action: z30.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  host: z30.string().describe("Host to monitor \u2014 idempotency key"),
-  port: z30.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
-  interval: z30.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
-  timeout: z30.string().optional().describe("Probe timeout (e.g. '500ms')"),
-  comment: z30.string().optional().describe("Optional comment"),
-  dryRun: z30.boolean().default(false).describe("Preview changes without applying")
+var manageNetwatchEntryInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  action: z31.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  host: z31.string().describe("Host to monitor \u2014 idempotency key"),
+  port: z31.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
+  interval: z31.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
+  timeout: z31.string().optional().describe("Probe timeout (e.g. '500ms')"),
+  comment: z31.string().optional().describe("Optional comment"),
+  dryRun: z31.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageNetwatchEntryTool = {
   name: "manage_netwatch_entry",
@@ -7018,7 +7042,7 @@ var manageNetwatchEntryTool = {
   snapshotPaths: ["tool/netwatch"],
   async handler(params, context) {
     const parsed = manageNetwatchEntryInputSchema.parse(params);
-    log31.info(
+    log32.info(
       { routerId: context.routerId, action: parsed.action, host: parsed.host },
       "Managing Netwatch entry"
     );
@@ -7075,7 +7099,7 @@ var manageNetwatchEntryTool = {
         if (parsed.timeout) body.timeout = parsed.timeout;
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("tool/netwatch", body);
-        log31.info({ host: parsed.host, id: created[".id"] }, "Netwatch entry added");
+        log32.info({ host: parsed.host, id: created[".id"] }, "Netwatch entry added");
         return {
           content: `Added Netwatch entry for "${parsed.host}".`,
           structuredContent: { action: "created", entry: created }
@@ -7099,7 +7123,7 @@ var manageNetwatchEntryTool = {
           };
         }
         await context.routerClient.remove("tool/netwatch", existing2[".id"]);
-        log31.info({ host: parsed.host }, "Netwatch entry removed");
+        log32.info({ host: parsed.host }, "Netwatch entry removed");
         return {
           content: `Removed Netwatch entry for "${parsed.host}".`,
           structuredContent: { action: "removed", host: parsed.host, id: existing2[".id"] }
@@ -7139,7 +7163,7 @@ var manageNetwatchEntryTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log31.info({ host: parsed.host, action: resultAction }, "Netwatch entry updated");
+      log32.info({ host: parsed.host, action: resultAction }, "Netwatch entry updated");
       return {
         content: `Netwatch entry for "${parsed.host}" ${resultAction}.`,
         structuredContent: { action: resultAction, host: parsed.host, id: existing[".id"] }
@@ -7150,10 +7174,10 @@ var manageNetwatchEntryTool = {
     }
   }
 };
-var listNeighborsInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  interface: z30.string().optional().describe("Filter by interface name (substring match)"),
-  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of neighbors to return")
+var listNeighborsInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  interface: z31.string().optional().describe("Filter by interface name (substring match)"),
+  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of neighbors to return")
 }).strict();
 var listNeighborsTool = {
   name: "list_neighbors",
@@ -7168,7 +7192,7 @@ var listNeighborsTool = {
   },
   async handler(params, context) {
     const parsed = listNeighborsInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Listing neighbors");
+    log32.info({ routerId: context.routerId }, "Listing neighbors");
     try {
       const allNeighbors = await context.routerClient.get("ip/neighbor", {
         limit: void 0,
@@ -7192,12 +7216,12 @@ var listNeighborsTool = {
     }
   }
 };
-var listArpEntriesInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  interface: z30.string().optional().describe("Filter by interface (substring match)"),
-  address: z30.string().optional().describe("Filter by IP address (substring match)"),
-  macAddress: z30.string().optional().describe("Filter by MAC address (substring match)"),
-  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of ARP entries to return")
+var listArpEntriesInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  interface: z31.string().optional().describe("Filter by interface (substring match)"),
+  address: z31.string().optional().describe("Filter by IP address (substring match)"),
+  macAddress: z31.string().optional().describe("Filter by MAC address (substring match)"),
+  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of ARP entries to return")
 }).strict();
 var listArpEntriesTool = {
   name: "list_arp_entries",
@@ -7212,7 +7236,7 @@ var listArpEntriesTool = {
   },
   async handler(params, context) {
     const parsed = listArpEntriesInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Listing ARP entries");
+    log32.info({ routerId: context.routerId }, "Listing ARP entries");
     try {
       const allEntries = await context.routerClient.get("ip/arp", {
         limit: void 0,
@@ -7245,51 +7269,602 @@ var networkServicesTools = [
   listArpEntriesTool
 ];
 
-// src/domain/tools/fleet-tools.ts
-import { z as z31 } from "zod";
-
-// src/middleware/authz.ts
-function matchesPattern(name, pattern) {
-  if (!pattern.includes("*")) return name === pattern;
-  const prefix = pattern.slice(0, pattern.indexOf("*"));
-  return name.startsWith(prefix);
-}
-function checkAuthz(identity, toolName, routerId) {
-  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId)) {
-    throw new MikroMCPError({
-      category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
-      code: "ROUTER_NOT_ALLOWED",
-      message: `Identity "${identity.id}" is not allowed to access router "${routerId}".`,
-      details: { identityId: identity.id, routerId, allowedRouters: identity.allowedRouters },
-      recoverability: {
-        retryable: false,
-        suggestedAction: `Add "${routerId}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
-      }
-    });
-  }
-  if (identity.allowedToolPatterns.length > 0) {
-    const allowed = identity.allowedToolPatterns.some((p) => matchesPattern(toolName, p));
-    if (!allowed) {
-      throw new MikroMCPError({
-        category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
-        code: "TOOL_NOT_ALLOWED",
-        message: `Identity "${identity.id}" is not allowed to call tool "${toolName}".`,
-        details: { identityId: identity.id, toolName, allowedToolPatterns: identity.allowedToolPatterns },
-        recoverability: {
-          retryable: false,
-          suggestedAction: `Add a matching pattern to allowedToolPatterns for identity "${identity.id}" in identities.yaml.`
-        }
-      });
-    }
-  }
+// src/domain/tools/vlan-tools.ts
+import { z as z32 } from "zod";
+var log33 = createLogger("vlan-tools");
+function sanitizeComment4(comment) {
+  if (comment === void 0) return void 0;
+  return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
-
-// src/adapter/ssh-client.ts
-import { createHash } from "crypto";
-import { Client } from "ssh2";
-var SshClient = class {
-  constructor(config, credentials, options) {
-    this.config = config;
+var manageVlanInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry"),
+  action: z32.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z32.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
+  vlanId: z32.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
+  parentInterface: z32.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
+  mtu: z32.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
+  disabled: z32.boolean().default(false).describe("Whether to create the VLAN disabled (add only)"),
+  comment: z32.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun: z32.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageVlanTool = {
+  name: "manage_vlan",
+  title: "Manage VLAN Interface",
+  description: "Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.",
+  inputSchema: manageVlanInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["interface/vlan"],
+  async handler(params, context) {
+    const parsed = manageVlanInputSchema.parse(params);
+    const comment = sanitizeComment4(parsed.comment);
+    log33.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing VLAN");
+    try {
+      const allVlans = await context.routerClient.get("interface/vlan", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allVlans.find((v) => v.name === parsed.name);
+      if (parsed.action === "add") {
+        if (parsed.vlanId === void 0) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "VLAN_ID_REQUIRED",
+            message: "vlanId is required when adding a VLAN.",
+            details: { name: parsed.name },
+            recoverability: { retryable: false, suggestedAction: "Provide vlanId (1-4094)." }
+          });
+        }
+        if (!parsed.parentInterface) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "VLAN_PARENT_REQUIRED",
+            message: "parentInterface is required when adding a VLAN.",
+            details: { name: parsed.name },
+            recoverability: { retryable: false, suggestedAction: "Provide the parent interface name." }
+          });
+        }
+        if (existing) {
+          if (existing["vlan-id"] === String(parsed.vlanId) && existing.interface === parsed.parentInterface) {
+            log33.info({ name: parsed.name }, "VLAN already exists with matching config");
+            return {
+              content: `VLAN "${parsed.name}" already exists with VLAN ID ${parsed.vlanId} on ${parsed.parentInterface}. No changes made.`,
+              structuredContent: { action: "already_exists", vlan: existing }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "VLAN_NAME_CONFLICT",
+            message: `VLAN "${parsed.name}" already exists but with different configuration (vlan-id=${existing["vlan-id"]}, interface=${existing.interface}).`,
+            details: {
+              existing: { vlanId: existing["vlan-id"], interface: existing.interface },
+              requested: { vlanId: parsed.vlanId, interface: parsed.parentInterface }
+            },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Use a different name or remove the existing VLAN first.",
+              alternativeTools: ["manage_vlan"]
+            }
+          });
+        }
+        if (parsed.dryRun) {
+          const diff = [
+            { property: "name", before: null, after: parsed.name },
+            { property: "vlan-id", before: null, after: String(parsed.vlanId) },
+            { property: "interface", before: null, after: parsed.parentInterface },
+            { property: "mtu", before: null, after: String(parsed.mtu) },
+            { property: "disabled", before: null, after: parsed.disabled ? "true" : "false" },
+            ...comment ? [{ property: "comment", before: null, after: comment }] : []
+          ];
+          return {
+            content: `Dry run: Would create VLAN "${parsed.name}" (ID ${parsed.vlanId}) on ${parsed.parentInterface} with MTU ${parsed.mtu}.`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        const body = {
+          name: parsed.name,
+          "vlan-id": String(parsed.vlanId),
+          interface: parsed.parentInterface,
+          mtu: String(parsed.mtu),
+          disabled: parsed.disabled ? "true" : "false"
+        };
+        if (comment) body.comment = comment;
+        const created = await context.routerClient.create("interface/vlan", body);
+        log33.info({ name: parsed.name, id: created[".id"] }, "VLAN created");
+        return {
+          content: `Created VLAN "${parsed.name}" (ID ${parsed.vlanId}) on ${parsed.parentInterface} with MTU ${parsed.mtu}.`,
+          structuredContent: { action: "created", vlan: created }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `VLAN "${parsed.name}" not found. Nothing to remove.`,
+            structuredContent: { action: "not_found", name: parsed.name }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove VLAN "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
+          };
+        }
+        await context.routerClient.remove("interface/vlan", existing[".id"]);
+        log33.info({ name: parsed.name }, "VLAN removed");
+        return {
+          content: `Removed VLAN "${parsed.name}".`,
+          structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+        };
+      }
+      if (!existing) {
+        throw new MikroMCPError({
+          category: "NOT_FOUND" /* NOT_FOUND */,
+          code: "VLAN_NOT_FOUND",
+          message: `VLAN "${parsed.name}" not found.`,
+          details: { name: parsed.name },
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Verify the VLAN name with list_interfaces.",
+            alternativeTools: ["list_interfaces"]
+          }
+        });
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would ${parsed.action} VLAN "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "disabled", before: existing.disabled, after: parsed.action === "disable" ? "true" : "false" }]
+          }
+        };
+      }
+      const disabledValue = parsed.action === "disable" ? "true" : "false";
+      await context.routerClient.update("interface/vlan", existing[".id"], { disabled: disabledValue });
+      const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
+      log33.info({ name: parsed.name, action: resultAction }, "VLAN updated");
+      return {
+        content: `VLAN "${parsed.name}" ${resultAction}.`,
+        structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_vlan" });
+    }
+  }
+};
+var vlanTools = [manageVlanTool];
+
+// src/domain/tools/dhcp-client-tools.ts
+import { z as z33 } from "zod";
+var log34 = createLogger("dhcp-client-tools");
+var listDhcpClientsInputSchema = z33.object({
+  routerId: z33.string().describe("Target router identifier from the router registry"),
+  interface: z33.string().optional().describe("Filter by interface name (exact match)"),
+  status: z33.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
+  limit: z33.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z33.number().int().min(0).default(0).describe("Offset for pagination")
+}).strict();
+var listDhcpClientsTool = {
+  name: "list_dhcp_clients",
+  title: "List DHCP Clients",
+  description: "List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.",
+  inputSchema: listDhcpClientsInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listDhcpClientsInputSchema.parse(params);
+    log34.info({ routerId: context.routerId }, "Listing DHCP clients");
+    try {
+      const allClients = await context.routerClient.get("ip/dhcp-client", {
+        limit: void 0,
+        offset: void 0
+      });
+      let filtered = allClients;
+      if (parsed.interface) {
+        filtered = filtered.filter((c) => c.interface === parsed.interface);
+      }
+      if (parsed.status !== "all") {
+        filtered = filtered.filter((c) => c.status === parsed.status);
+      }
+      const total = filtered.length;
+      const clients = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
+      const lines = [
+        `DHCP clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`
+      ];
+      for (const c of clients) {
+        const rec = c;
+        const iface = rec.interface ?? "unknown";
+        const status = rec.status ?? "unknown";
+        const address = rec.address ?? rec["active-address"] ?? "-";
+        const isDisabled = rec.disabled === true || rec.disabled === "true";
+        lines.push(`  ${iface}  [${status}]  ${address}${isDisabled ? "  DISABLED" : ""}`);
+      }
+      return {
+        content: lines.join("\n"),
+        structuredContent: {
+          routerId: context.routerId,
+          clients,
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_clients" });
+    }
+  }
+};
+var manageDhcpClientInputSchema = z33.object({
+  routerId: z33.string().describe("Target router identifier from the router registry"),
+  action: z33.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  interface: z33.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
+  usePeerDns: z33.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
+  usePeerNtp: z33.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
+  addDefaultRoute: z33.boolean().default(true).describe("Add default route from DHCP (add only)"),
+  comment: z33.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun: z33.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageDhcpClientTool = {
+  name: "manage_dhcp_client",
+  title: "Manage DHCP Client",
+  description: "Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.",
+  inputSchema: manageDhcpClientInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["ip/dhcp-client"],
+  async handler(params, context) {
+    const parsed = manageDhcpClientInputSchema.parse(params);
+    log34.info({ routerId: context.routerId, action: parsed.action, interface: parsed.interface }, "Managing DHCP client");
+    try {
+      const allClients = await context.routerClient.get("ip/dhcp-client", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allClients.find(
+        (c) => c.interface === parsed.interface
+      );
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `DHCP client already configured on "${parsed.interface}". No changes made.`,
+            structuredContent: { action: "already_exists", client: existing }
+          };
+        }
+        if (parsed.dryRun) {
+          const diff = [
+            { property: "interface", before: null, after: parsed.interface },
+            { property: "use-peer-dns", before: null, after: parsed.usePeerDns ? "yes" : "no" },
+            { property: "use-peer-ntp", before: null, after: parsed.usePeerNtp ? "yes" : "no" },
+            { property: "add-default-route", before: null, after: parsed.addDefaultRoute ? "yes" : "no" }
+          ];
+          return {
+            content: `Dry run: Would add DHCP client on "${parsed.interface}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        const body = {
+          interface: parsed.interface,
+          "use-peer-dns": parsed.usePeerDns ? "yes" : "no",
+          "use-peer-ntp": parsed.usePeerNtp ? "yes" : "no",
+          "add-default-route": parsed.addDefaultRoute ? "yes" : "no"
+        };
+        if (parsed.comment) body.comment = parsed.comment;
+        const created = await context.routerClient.create("ip/dhcp-client", body);
+        log34.info({ interface: parsed.interface, id: created[".id"] }, "DHCP client added");
+        return {
+          content: `Added DHCP client on "${parsed.interface}".`,
+          structuredContent: { action: "created", client: created }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `No DHCP client found on "${parsed.interface}". Nothing to remove.`,
+            structuredContent: { action: "not_found", interface: parsed.interface }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove DHCP client on "${parsed.interface}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "interface", before: parsed.interface, after: null }]
+            }
+          };
+        }
+        await context.routerClient.remove("ip/dhcp-client", existing[".id"]);
+        log34.info({ interface: parsed.interface }, "DHCP client removed");
+        return {
+          content: `Removed DHCP client on "${parsed.interface}".`,
+          structuredContent: { action: "removed", interface: parsed.interface, id: existing[".id"] }
+        };
+      }
+      if (!existing) {
+        throw new MikroMCPError({
+          category: "NOT_FOUND" /* NOT_FOUND */,
+          code: "DHCP_CLIENT_NOT_FOUND",
+          message: `No DHCP client found on interface "${parsed.interface}".`,
+          details: { interface: parsed.interface },
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Verify with list_dhcp_clients.",
+            alternativeTools: ["list_dhcp_clients"]
+          }
+        });
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would ${parsed.action} DHCP client on "${parsed.interface}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [
+              {
+                property: "disabled",
+                before: existing.disabled,
+                after: parsed.action === "disable" ? "true" : "false"
+              }
+            ]
+          }
+        };
+      }
+      const disabledValue = parsed.action === "disable" ? "true" : "false";
+      await context.routerClient.update("ip/dhcp-client", existing[".id"], { disabled: disabledValue });
+      const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
+      log34.info({ interface: parsed.interface, action: resultAction }, "DHCP client updated");
+      return {
+        content: `DHCP client on "${parsed.interface}" ${resultAction}.`,
+        structuredContent: { action: resultAction, interface: parsed.interface, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_client" });
+    }
+  }
+};
+var dhcpClientTools = [listDhcpClientsTool, manageDhcpClientTool];
+
+// src/domain/tools/ip-service-tools.ts
+import { z as z34 } from "zod";
+var log35 = createLogger("ip-service-tools");
+var SERVICE_NAMES = ["api", "api-ssl", "ssh", "telnet", "www", "www-ssl", "winbox", "ftp"];
+var listIpServicesInputSchema = z34.object({
+  routerId: z34.string().describe("Target router identifier from the router registry"),
+  name: z34.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  enabled: z34.boolean().optional().describe("When true, return only enabled services; when false, only disabled services")
+}).strict();
+var listIpServicesTool = {
+  name: "list_ip_services",
+  title: "List IP Services",
+  description: "List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.",
+  inputSchema: listIpServicesInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listIpServicesInputSchema.parse(params);
+    log35.info({ routerId: context.routerId }, "Listing IP services");
+    try {
+      const allServices = await context.routerClient.get("ip/service", {
+        limit: void 0,
+        offset: void 0
+      });
+      let filtered = allServices;
+      if (parsed.name) {
+        filtered = filtered.filter((s) => s.name === parsed.name);
+      }
+      if (parsed.enabled !== void 0) {
+        filtered = filtered.filter((s) => {
+          const isDisabled = s.disabled === true || s.disabled === "true";
+          return parsed.enabled ? !isDisabled : isDisabled;
+        });
+      }
+      const lines = [`IP services on ${context.routerId}: ${filtered.length} returned`];
+      for (const s of filtered) {
+        const rec = s;
+        const isDisabled = rec.disabled === true || rec.disabled === "true";
+        lines.push(`  ${rec.name}  port:${rec.port ?? "-"}  [${isDisabled ? "DISABLED" : "enabled"}]`);
+      }
+      return {
+        content: lines.join("\n"),
+        structuredContent: {
+          routerId: context.routerId,
+          services: filtered,
+          total: filtered.length
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_ip_services" });
+    }
+  }
+};
+var manageIpServiceInputSchema = z34.object({
+  routerId: z34.string().describe("Target router identifier from the router registry"),
+  action: z34.enum(["enable", "disable"]).describe(
+    "Action to perform \u2014 only enable/disable to prevent accidental lockout from changing ports"
+  ),
+  name: z34.enum(SERVICE_NAMES).describe("Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  dryRun: z34.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageIpServiceTool = {
+  name: "manage_ip_service",
+  title: "Manage IP Service",
+  description: "Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.",
+  inputSchema: manageIpServiceInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = manageIpServiceInputSchema.parse(params);
+    log35.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP service");
+    try {
+      const allServices = await context.routerClient.get("ip/service", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allServices.find((s) => s.name === parsed.name);
+      if (!existing) {
+        throw new MikroMCPError({
+          category: "NOT_FOUND" /* NOT_FOUND */,
+          code: "IP_SERVICE_NOT_FOUND",
+          message: `IP service "${parsed.name}" not found on router.`,
+          details: { name: parsed.name },
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Verify service name with list_ip_services.",
+            alternativeTools: ["list_ip_services"]
+          }
+        });
+      }
+      const isCurrentlyDisabled = existing.disabled === "true" || existing.disabled === true;
+      const wouldBeDisabled = parsed.action === "disable";
+      if (isCurrentlyDisabled === wouldBeDisabled) {
+        const alreadyState = parsed.action === "disable" ? "disabled" : "enabled";
+        return {
+          content: `IP service "${parsed.name}" is already ${alreadyState}. No changes made.`,
+          structuredContent: { action: "no_change", name: parsed.name, id: existing[".id"] }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would ${parsed.action} IP service "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [
+              {
+                property: "disabled",
+                before: existing.disabled,
+                after: parsed.action === "disable" ? "true" : "false"
+              }
+            ]
+          }
+        };
+      }
+      const disabledValue = parsed.action === "disable" ? "true" : "false";
+      await context.routerClient.update("ip/service", existing[".id"], { disabled: disabledValue });
+      const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
+      log35.info({ name: parsed.name, action: resultAction }, "IP service updated");
+      return {
+        content: `IP service "${parsed.name}" ${resultAction}.`,
+        structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ip_service" });
+    }
+  }
+};
+var ipServiceTools = [listIpServicesTool, manageIpServiceTool];
+
+// src/domain/tools/fleet-tools.ts
+import { z as z35 } from "zod";
+
+// src/middleware/authz.ts
+function matchesPattern(name, pattern) {
+  if (!pattern.includes("*")) return name === pattern;
+  const prefix = pattern.slice(0, pattern.indexOf("*"));
+  return name.startsWith(prefix);
+}
+function checkAuthz(identity, toolName, routerId) {
+  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId)) {
+    throw new MikroMCPError({
+      category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+      code: "ROUTER_NOT_ALLOWED",
+      message: `Identity "${identity.id}" is not allowed to access router "${routerId}".`,
+      details: { identityId: identity.id, routerId, allowedRouters: identity.allowedRouters },
+      recoverability: {
+        retryable: false,
+        suggestedAction: `Add "${routerId}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
+      }
+    });
+  }
+  if (identity.allowedToolPatterns.length > 0) {
+    const allowed = identity.allowedToolPatterns.some((p) => matchesPattern(toolName, p));
+    if (!allowed) {
+      throw new MikroMCPError({
+        category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+        code: "TOOL_NOT_ALLOWED",
+        message: `Identity "${identity.id}" is not allowed to call tool "${toolName}".`,
+        details: { identityId: identity.id, toolName, allowedToolPatterns: identity.allowedToolPatterns },
+        recoverability: {
+          retryable: false,
+          suggestedAction: `Add a matching pattern to allowedToolPatterns for identity "${identity.id}" in identities.yaml.`
+        }
+      });
+    }
+  }
+}
+
+// src/config/secrets.ts
+function getCredentials(router) {
+  const { source, envPrefix, vaultPath } = router.credentials;
+  if (source === "vault") {
+    throw new MikroMCPError({
+      category: "CONFIGURATION" /* CONFIGURATION */,
+      code: "VAULT_NOT_SUPPORTED",
+      message: `Vault credential source is not supported in v0.1 (vaultPath=${vaultPath ?? "n/a"})`,
+      recoverability: {
+        retryable: false,
+        suggestedAction: 'Switch to source="env" and provide credentials via environment variables.'
+      }
+    });
+  }
+  if (!envPrefix) {
+    throw new MikroMCPError({
+      category: "CONFIGURATION" /* CONFIGURATION */,
+      code: "MISSING_ENV_PREFIX",
+      message: `Router "${router.id}" uses source="env" but no envPrefix is configured`,
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Set envPrefix in the router configuration."
+      }
+    });
+  }
+  const userKey = `${envPrefix}_USER`;
+  const passKey = `${envPrefix}_PASS`;
+  const username = process.env[userKey];
+  const password = process.env[passKey];
+  if (!username || !password) {
+    const missing = [!username ? userKey : null, !password ? passKey : null].filter(Boolean);
+    throw new MikroMCPError({
+      category: "CONFIGURATION" /* CONFIGURATION */,
+      code: "MISSING_CREDENTIALS",
+      message: `Missing environment variable(s) for router "${router.id}": ${missing.join(", ")}`,
+      details: { missing },
+      recoverability: {
+        retryable: false,
+        suggestedAction: `Set the ${missing.join(" and ")} environment variable(s).`
+      }
+    });
+  }
+  return { username, password };
+}
+
+// src/adapter/ssh-client.ts
+import { createHash } from "crypto";
+import { Client } from "ssh2";
+var SshClient = class {
+  constructor(config, credentials, options) {
+    this.config = config;
     this.credentials = credentials;
     this.commandTimeoutMs = options?.commandTimeoutMs ?? 3e4;
     this.maxOutputBytes = options?.maxOutputBytes ?? 512 * 1024;
@@ -7356,8 +7931,8 @@ var SshClient = class {
       };
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
-        connectOptions.hostVerifier = (key) => {
-          const actual = createHash("sha256").update(key).digest("hex");
+        connectOptions.hostVerifier = (key2) => {
+          const actual = createHash("sha256").update(key2).digest("hex");
           return actual === expected;
         };
       }
@@ -7369,7 +7944,7 @@ var SshClient = class {
 // src/adapter/ftp-client.ts
 import { Client as Client2 } from "basic-ftp";
 import { Readable } from "stream";
-var log32 = createLogger("ftp-client");
+var log36 = createLogger("ftp-client");
 var FtpClient = class {
   #host;
   #port;
@@ -7382,7 +7957,7 @@ var FtpClient = class {
     this.#password = password;
   }
   async upload(remoteName, content) {
-    log32.info({ host: this.#host, remoteName }, "Uploading file via FTP");
+    log36.info({ host: this.#host, remoteName }, "Uploading file via FTP");
     const client = new Client2();
     try {
       await client.access({
@@ -7392,7 +7967,7 @@ var FtpClient = class {
         password: this.#password
       });
       await client.uploadFrom(Readable.from(Buffer.from(content, "utf-8")), remoteName);
-      log32.info({ host: this.#host, remoteName }, "FTP upload complete");
+      log36.info({ host: this.#host, remoteName }, "FTP upload complete");
     } finally {
       client.close();
     }
@@ -7413,51 +7988,6 @@ var FtpClient = class {
   }
 };
 
-// src/config/secrets.ts
-function getCredentials(router) {
-  const { source, envPrefix, vaultPath } = router.credentials;
-  if (source === "vault") {
-    throw new MikroMCPError({
-      category: "CONFIGURATION" /* CONFIGURATION */,
-      code: "VAULT_NOT_SUPPORTED",
-      message: `Vault credential source is not supported in v0.1 (vaultPath=${vaultPath ?? "n/a"})`,
-      recoverability: {
-        retryable: false,
-        suggestedAction: 'Switch to source="env" and provide credentials via environment variables.'
-      }
-    });
-  }
-  if (!envPrefix) {
-    throw new MikroMCPError({
-      category: "CONFIGURATION" /* CONFIGURATION */,
-      code: "MISSING_ENV_PREFIX",
-      message: `Router "${router.id}" uses source="env" but no envPrefix is configured`,
-      recoverability: {
-        retryable: false,
-        suggestedAction: "Set envPrefix in the router configuration."
-      }
-    });
-  }
-  const userKey = `${envPrefix}_USER`;
-  const passKey = `${envPrefix}_PASS`;
-  const username = process.env[userKey];
-  const password = process.env[passKey];
-  if (!username || !password) {
-    const missing = [!username ? userKey : null, !password ? passKey : null].filter(Boolean);
-    throw new MikroMCPError({
-      category: "CONFIGURATION" /* CONFIGURATION */,
-      code: "MISSING_CREDENTIALS",
-      message: `Missing environment variable(s) for router "${router.id}": ${missing.join(", ")}`,
-      details: { missing },
-      recoverability: {
-        retryable: false,
-        suggestedAction: `Set the ${missing.join(" and ")} environment variable(s).`
-      }
-    });
-  }
-  return { username, password };
-}
-
 // src/adapter/adapter-factory.ts
 function createSshClient(routerConfig, options) {
   const creds = getCredentials(routerConfig);
@@ -7468,17 +7998,96 @@ function createFtpClient(routerConfig) {
   return new FtpClient(routerConfig.host, 21, creds.username, creds.password);
 }
 
+// src/mcp/tool-context.ts
+function buildRouterToolContext(args) {
+  const { routerConfig, correlationId, identity, pool, config, registry } = args;
+  const credentials = getCredentials(routerConfig);
+  return {
+    routerClient: pool.getClient(routerConfig, credentials),
+    routerId: routerConfig.id,
+    correlationId,
+    routerConfig,
+    sshClient: createSshClient(routerConfig, config.ssh),
+    ftpClient: createFtpClient(routerConfig),
+    identity,
+    routerRegistry: registry,
+    connectionPool: pool,
+    appConfig: config
+  };
+}
+
+// src/middleware/fleet-confirmation.ts
+import { createHmac, createHash as createHash2 } from "crypto";
+var CONFIRMATION_TTL_MS = 5 * 60 * 1e3;
+var pending = /* @__PURE__ */ new Map();
+function fingerprint(args) {
+  const sortedRouters = [...args.routerIds].sort();
+  const payload = JSON.stringify({
+    toolName: args.toolName,
+    routerIds: sortedRouters,
+    params: args.params,
+    identityId: args.identityId
+  });
+  return createHash2("sha256").update(payload).digest("hex");
+}
+function evictExpired() {
+  const now = /* @__PURE__ */ new Date();
+  for (const [token, entry] of pending) {
+    if (entry.expiresAt <= now) pending.delete(token);
+  }
+}
+function checkFleetConfirmation(args, secret) {
+  evictExpired();
+  const fp = fingerprint(args);
+  if (args.submittedToken) {
+    const entry = pending.get(args.submittedToken);
+    if (!entry || entry.expiresAt <= /* @__PURE__ */ new Date() || entry.fingerprint !== fp) {
+      throw new MikroMCPError({
+        category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+        code: "FLEET_CONFIRMATION_MISMATCH",
+        message: "Fleet confirmation token is expired, already used, or does not match the current toolName/routerIds/params.",
+        recoverability: {
+          retryable: true,
+          suggestedAction: "Re-submit bulk_execute without confirmationToken to get a fresh token."
+        }
+      });
+    }
+    pending.delete(args.submittedToken);
+    return;
+  }
+  const expiresAt = new Date(Date.now() + CONFIRMATION_TTL_MS);
+  const token = createHmac("sha256", secret).update(`${fp}:${expiresAt.toISOString()}`).digest("hex");
+  pending.set(token, { expiresAt, fingerprint: fp });
+  throw new MikroMCPError({
+    category: "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */,
+    code: "FLEET_CONFIRMATION_REQUIRED",
+    message: `This will run destructive tool "${args.toolName}" across ${args.routerIds.length} router(s). Re-submit with confirmationToken to proceed.`,
+    details: {
+      confirmationToken: token,
+      expiresAt: expiresAt.toISOString(),
+      routerCount: args.routerIds.length
+    },
+    recoverability: {
+      retryable: true,
+      suggestedAction: "Re-submit the identical bulk_execute call with details.confirmationToken."
+    }
+  });
+}
+
 // src/domain/tools/fleet-tools.ts
-var log33 = createLogger("fleet-tools");
-var checkHealthInputSchema = z31.object({
-  routerId: z31.string().describe("Target router to health-check")
+var log37 = createLogger("fleet-tools");
+var checkHealthInputSchema = z35.object({
+  routerId: z35.string().describe("Target router to health-check")
 }).strict();
-var bulkExecuteInputSchema = z31.object({
-  toolName: z31.string().describe("Name of the tool to fan out (must be a single-router tool)"),
-  routerIds: z31.array(z31.string()).optional().describe("Explicit list of router IDs to target"),
-  tags: z31.array(z31.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
-  params: z31.record(z31.string(), z31.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
-  concurrency: z31.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls")
+var bulkExecuteInputSchema = z35.object({
+  toolName: z35.string().describe("Name of the tool to fan out (must be a single-router tool)"),
+  routerIds: z35.array(z35.string()).optional().describe("Explicit list of router IDs to target"),
+  tags: z35.array(z35.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
+  params: z35.record(z35.string(), z35.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
+  concurrency: z35.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
+  confirmationToken: z35.string().optional().describe(
+    "Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool."
+  )
 }).strict();
 function createFleetTools(baseTools2) {
   const toolMap = new Map(baseTools2.map((t) => [t.name, t]));
@@ -7495,7 +8104,7 @@ function createFleetTools(baseTools2) {
     },
     async handler(params, context) {
       checkHealthInputSchema.parse(params);
-      log33.info({ routerId: context.routerId }, "Checking router health");
+      log37.info({ routerId: context.routerId }, "Checking router health");
       const startMs = Date.now();
       try {
         const resources = await context.routerClient.get("system/resource");
@@ -7533,7 +8142,7 @@ function createFleetTools(baseTools2) {
   const bulkExecuteTool = {
     name: "bulk_execute",
     title: "Bulk Execute",
-    description: "Fan out a single-router tool to multiple routers in parallel (up to `concurrency` at a time). Target routers via explicit routerIds or by tag. Destructive tools are not allowed. Returns per-router results with succeeded/failed counts.",
+    description: "Fan out a single-router tool to multiple routers in parallel (up to `concurrency` at a time). Target routers via explicit routerIds or by tag. Non-destructive tools fan out immediately. Destructive tools require a two-step confirmation: call without `confirmationToken` to receive a fleet token (requires `MIKROMCP_CONFIRMATION_SECRET`), then re-call with that token to proceed. Returns per-router results with succeeded/failed counts.",
     inputSchema: bulkExecuteInputSchema,
     annotations: {
       readOnlyHint: false,
@@ -7557,10 +8166,21 @@ function createFleetTools(baseTools2) {
           }
         });
       }
-      log33.info(
+      log37.info(
         { toolName: parsed.toolName, concurrency: parsed.concurrency },
         "bulk_execute invoked"
       );
+      auditLog({
+        type: "audit",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        correlationId: context.correlationId,
+        identityId: context.identity.id,
+        role: context.identity.role,
+        tool: "bulk_execute",
+        routerId: "(fleet)",
+        phase: "attempt",
+        params: { toolName: parsed.toolName, routerIds: parsed.routerIds, tags: parsed.tags }
+      }, context.appConfig.auditLogPath);
       if (parsed.toolName === "bulk_execute" || parsed.toolName === "check_router_health") {
         throw new MikroMCPError({
           category: "VALIDATION" /* VALIDATION */,
@@ -7585,17 +8205,6 @@ function createFleetTools(baseTools2) {
         });
       }
       const targetTool = foundTool;
-      if (targetTool.annotations.destructiveHint) {
-        throw new MikroMCPError({
-          category: "VALIDATION" /* VALIDATION */,
-          code: "BULK_DESTRUCTIVE_NOT_ALLOWED",
-          message: `Tool "${parsed.toolName}" is destructive. Destructive tools require per-router confirmation and cannot be fanned out via bulk_execute.`,
-          recoverability: {
-            retryable: false,
-            suggestedAction: "Call the tool directly on each router to provide the required confirmation token."
-          }
-        });
-      }
       const preErrors = [];
       let routers;
       if (hasRouterIds) {
@@ -7604,15 +8213,56 @@ function createFleetTools(baseTools2) {
           try {
             resolved.push(context.routerRegistry.getRouter(id));
           } catch {
-            log33.warn({ routerId: id }, "bulk_execute: router not found");
-            preErrors.push({ routerId: id, status: "error", error: `Router "${id}" not found in registry`, durationMs: 0 });
+            log37.warn({ routerId: id }, "bulk_execute: router not found");
+            preErrors.push({
+              routerId: id,
+              status: "error",
+              error: `Router "${id}" not found in registry`,
+              durationMs: 0
+            });
           }
         }
         routers = resolved;
       } else {
         routers = context.routerRegistry.listRouters(parsed.tags);
       }
+      if (targetTool.annotations.destructiveHint) {
+        const secret = context.appConfig.confirmationSecret;
+        if (!secret) {
+          throw new MikroMCPError({
+            category: "CONFIGURATION" /* CONFIGURATION */,
+            code: "FLEET_CONFIRMATION_UNAVAILABLE",
+            message: "Fanning out a destructive tool requires MIKROMCP_CONFIRMATION_SECRET to be configured.",
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Set MIKROMCP_CONFIRMATION_SECRET, or call the tool per-router."
+            }
+          });
+        }
+        const routerIdList = routers.map((r) => r.id);
+        checkFleetConfirmation(
+          {
+            toolName: parsed.toolName,
+            routerIds: routerIdList,
+            params: parsed.params,
+            identityId: context.identity.id,
+            submittedToken: parsed.confirmationToken
+          },
+          secret
+        );
+      }
       if (routers.length === 0 && preErrors.length === 0) {
+        auditLog({
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId: context.correlationId,
+          identityId: context.identity.id,
+          role: context.identity.role,
+          tool: "bulk_execute",
+          routerId: "(fleet)",
+          phase: "success",
+          params: { toolName: parsed.toolName, succeeded: 0, failed: 0 }
+        }, context.appConfig.auditLogPath);
         return {
           content: `Executed ${parsed.toolName} on 0 routers: 0 succeeded, 0 failed`,
           structuredContent: {
@@ -7628,28 +8278,50 @@ function createFleetTools(baseTools2) {
         const start = Date.now();
         try {
           checkAuthz(context.identity, parsed.toolName, router.id);
-          const credentials = getCredentials(router);
-          const client = context.connectionPool.getClient(router, credentials);
-          const sshClient = createSshClient(router, {});
-          const ftpClient = createFtpClient(router);
-          const routerContext = {
-            routerClient: client,
-            routerId: router.id,
-            correlationId: context.correlationId,
+          const routerContext = buildRouterToolContext({
             routerConfig: router,
-            sshClient,
-            ftpClient,
-            identity: context.identity
-          };
+            correlationId: context.correlationId,
+            identity: context.identity,
+            pool: context.connectionPool,
+            config: context.appConfig,
+            registry: context.routerRegistry
+          });
           const toolParams = { ...parsed.params, routerId: router.id };
           const result = await targetTool.handler(
             toolParams,
             routerContext
           );
-          return { routerId: router.id, status: "ok", result, durationMs: Date.now() - start };
+          const elapsed = Date.now() - start;
+          auditLog({
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId: context.correlationId,
+            identityId: context.identity.id,
+            role: context.identity.role,
+            tool: parsed.toolName,
+            routerId: router.id,
+            phase: "success",
+            params: parsed.params,
+            durationMs: elapsed
+          }, context.appConfig.auditLogPath);
+          return { routerId: router.id, status: "ok", result, durationMs: elapsed };
         } catch (err) {
+          const elapsed = Date.now() - start;
           const message = err instanceof Error ? err.message : String(err);
-          return { routerId: router.id, status: "error", error: message, durationMs: Date.now() - start };
+          auditLog({
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId: context.correlationId,
+            identityId: context.identity.id,
+            role: context.identity.role,
+            tool: parsed.toolName,
+            routerId: router.id,
+            phase: "failure",
+            params: parsed.params,
+            outcome: message,
+            durationMs: elapsed
+          }, context.appConfig.auditLogPath);
+          return { routerId: router.id, status: "error", error: message, durationMs: elapsed };
         }
       }
       const results2 = [...preErrors];
@@ -7660,6 +8332,17 @@ function createFleetTools(baseTools2) {
       }
       const succeeded = results2.filter((r) => r.status === "ok").length;
       const failed = results2.filter((r) => r.status === "error").length;
+      auditLog({
+        type: "audit",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        correlationId: context.correlationId,
+        identityId: context.identity.id,
+        role: context.identity.role,
+        tool: "bulk_execute",
+        routerId: "(fleet)",
+        phase: "success",
+        params: { toolName: parsed.toolName, succeeded, failed }
+      }, context.appConfig.auditLogPath);
       return {
         content: `Executed ${parsed.toolName} on ${results2.length} routers: ${succeeded} succeeded, ${failed} failed`,
         structuredContent: {
@@ -7702,9 +8385,13 @@ var baseTools = [
   ...certificateTools,
   ...userTools,
   ...dhcpServerTools,
+  ...ipPoolTools,
   ...queueTools,
   ...vrrpTools,
-  ...networkServicesTools
+  ...networkServicesTools,
+  ...vlanTools,
+  ...dhcpClientTools,
+  ...ipServiceTools
 ];
 var allTools = [
   ...baseTools,
@@ -7712,159 +8399,8 @@ var allTools = [
   ...createFleetTools(baseTools)
 ];
 
-// src/adapter/retry-engine.ts
-var DEFAULTS = {
-  maxRetries: 3,
-  baseDelayMs: 200,
-  maxDelayMs: 5e3
-};
-var RETRYABLE_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "ENOTFOUND"]);
-function isRetryable(error) {
-  if (error instanceof Error) {
-    const code = error.code;
-    if (code && RETRYABLE_CODES.has(code)) {
-      return true;
-    }
-    const statusCode = error.statusCode;
-    if (typeof statusCode === "number") {
-      return statusCode >= 500;
-    }
-  }
-  return false;
-}
-async function withRetry(fn, options) {
-  const opts = { ...DEFAULTS, ...options };
-  let lastError;
-  for (let attempt = 0; attempt <= opts.maxRetries; attempt++) {
-    try {
-      return await fn();
-    } catch (error) {
-      lastError = error;
-      if (attempt >= opts.maxRetries || !isRetryable(error)) {
-        throw error;
-      }
-      const exponentialDelay = opts.baseDelayMs * 2 ** attempt;
-      const jitter = Math.random() * opts.baseDelayMs;
-      const delay = Math.min(exponentialDelay + jitter, opts.maxDelayMs);
-      await new Promise((resolve) => setTimeout(resolve, delay));
-    }
-  }
-  throw lastError;
-}
-
-// src/adapter/circuit-breaker.ts
-var TRANSIENT_CATEGORIES = /* @__PURE__ */ new Set([
-  "ROUTER_UNREACHABLE" /* ROUTER_UNREACHABLE */,
-  "ROUTER_TIMEOUT" /* ROUTER_TIMEOUT */,
-  "ROUTER_ERROR" /* ROUTER_ERROR */,
-  "ROUTER_BUSY" /* ROUTER_BUSY */
-]);
-function isTransientFailure(error) {
-  if (!(error instanceof MikroMCPError)) {
-    return false;
-  }
-  return TRANSIENT_CATEGORIES.has(error.category);
-}
-var DEFAULTS2 = {
-  failureThreshold: 5,
-  cooldownMs: 3e4
-};
-var CircuitBreaker = class {
-  constructor(routerId, options) {
-    this.routerId = routerId;
-    this.options = { ...DEFAULTS2, ...options };
-  }
-  routerId;
-  options;
-  currentState = "closed";
-  consecutiveFailures = 0;
-  lastFailureTime = 0;
-  get state() {
-    if (this.currentState === "open") {
-      const elapsed = Date.now() - this.lastFailureTime;
-      if (elapsed >= this.options.cooldownMs) {
-        this.currentState = "half-open";
-      }
-    }
-    return this.currentState;
-  }
-  /**
-   * Execute `fn` through the circuit breaker.
-   *
-   * - **closed**: execute normally; track consecutive failures.
-   * - **open**: reject immediately with `ROUTER_BUSY`.
-   * - **half-open**: execute as a probe; success closes, failure reopens.
-   */
-  async execute(fn) {
-    const currentState = this.state;
-    if (currentState === "open") {
-      throw new MikroMCPError({
-        category: "ROUTER_BUSY" /* ROUTER_BUSY */,
-        code: "CIRCUIT_OPEN",
-        message: `Circuit breaker is open for router "${this.routerId}". Try again after cooldown.`,
-        details: {
-          routerId: this.routerId,
-          consecutiveFailures: this.consecutiveFailures,
-          cooldownMs: this.options.cooldownMs
-        },
-        recoverability: {
-          retryable: true,
-          retryAfterMs: this.options.cooldownMs,
-          suggestedAction: "Wait for the circuit breaker cooldown period to expire, then retry."
-        }
-      });
-    }
-    try {
-      const result = await fn();
-      this.onSuccess();
-      return result;
-    } catch (error) {
-      if (isTransientFailure(error)) {
-        this.onFailure();
-      }
-      throw error;
-    }
-  }
-  /** Force the circuit back to the closed state. */
-  reset() {
-    this.currentState = "closed";
-    this.consecutiveFailures = 0;
-    this.lastFailureTime = 0;
-  }
-  // ---------- internal helpers ----------
-  onSuccess() {
-    this.consecutiveFailures = 0;
-    this.currentState = "closed";
-  }
-  onFailure() {
-    this.consecutiveFailures++;
-    this.lastFailureTime = Date.now();
-    if (this.currentState === "half-open") {
-      this.currentState = "open";
-    } else if (this.consecutiveFailures >= this.options.failureThreshold) {
-      this.currentState = "open";
-    }
-  }
-};
-
-// src/mcp/response-formatter.ts
-function formatToolResult(result) {
-  return {
-    content: [{ type: "text", text: result.content }],
-    structuredContent: result.structuredContent,
-    ...result.isError ? { isError: true } : {}
-  };
-}
-function formatError(error) {
-  const hint = error.recoverability.suggestedAction;
-  const text = `Error [${error.category}]: ${error.message}${hint ? `
-Suggested action: ${hint}` : ""}`;
-  return {
-    content: [{ type: "text", text }],
-    structuredContent: error.toJSON(),
-    isError: true
-  };
-}
+// src/mcp/tool-executor.ts
+import { nanoid as nanoid4 } from "nanoid";
 
 // src/observability/correlation.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -7880,9 +8416,6 @@ function withContext(ctx, fn) {
   return requestContext.run(fullContext, fn);
 }
 
-// src/mcp/tool-registry.ts
-import { nanoid as nanoid4 } from "nanoid";
-
 // src/middleware/auth.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var identityStorage = new AsyncLocalStorage2();
@@ -7951,19 +8484,19 @@ function getStdioIdentity(stdioIdentityName, registry) {
 }
 
 // src/middleware/confirmation.ts
-import { createHmac, createHash as createHash2 } from "crypto";
-var CONFIRMATION_TTL_MS = 5 * 60 * 1e3;
+import { createHmac as createHmac2, createHash as createHash3 } from "crypto";
+var CONFIRMATION_TTL_MS2 = 5 * 60 * 1e3;
 var BYPASS_ROLES = ["admin", "superadmin"];
 var pendingConfirmations = /* @__PURE__ */ new Map();
 function computeParamHash(params) {
   const { confirmationToken: _, ...rest } = params;
-  return createHash2("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function computeToken(tool, routerId, identityId, paramHash, expiresAt, secret) {
   const payload = JSON.stringify({ tool, routerId, paramHash, identityId, expiresAt });
-  return createHmac("sha256", secret).update(payload).digest("hex");
+  return createHmac2("sha256", secret).update(payload).digest("hex");
 }
-function evictExpired() {
+function evictExpired2() {
   const now = /* @__PURE__ */ new Date();
   for (const [token, entry] of pendingConfirmations) {
     if (entry.expiresAt <= now) pendingConfirmations.delete(token);
@@ -7971,7 +8504,7 @@ function evictExpired() {
 }
 async function checkConfirmation(toolName, routerId, params, identity, secret) {
   if (BYPASS_ROLES.includes(identity.role)) return;
-  evictExpired();
+  evictExpired2();
   const submittedToken = typeof params.confirmationToken === "string" ? params.confirmationToken : null;
   if (submittedToken) {
     const entry = pendingConfirmations.get(submittedToken);
@@ -7998,34 +8531,77 @@ async function checkConfirmation(toolName, routerId, params, identity, secret) {
         }
       });
     }
-    pendingConfirmations.delete(submittedToken);
-    return;
+    pendingConfirmations.delete(submittedToken);
+    return;
+  }
+  const expiresAt = new Date(Date.now() + CONFIRMATION_TTL_MS2).toISOString();
+  const paramHash = computeParamHash(params);
+  const token = computeToken(toolName, routerId, identity.id, paramHash, expiresAt, secret);
+  pendingConfirmations.set(token, {
+    expiresAt: new Date(expiresAt),
+    tool: toolName,
+    routerId,
+    identityId: identity.id,
+    paramHash
+  });
+  throw new MikroMCPError({
+    category: "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */,
+    code: "CONFIRMATION_REQUIRED",
+    message: "This action is destructive. Re-submit with confirmationToken to proceed.",
+    details: {
+      confirmationToken: token,
+      expiresAt,
+      tool: toolName,
+      routerId
+    },
+    recoverability: {
+      retryable: true,
+      suggestedAction: "Re-submit the exact same tool call with the confirmationToken from details.confirmationToken."
+    }
+  });
+}
+
+// src/adapter/retry-engine.ts
+var DEFAULTS = {
+  maxRetries: 3,
+  baseDelayMs: 200,
+  maxDelayMs: 5e3
+};
+var RETRYABLE_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "ENOTFOUND"]);
+function isRetryable(error) {
+  if (error instanceof MikroMCPError) {
+    return error.recoverability.retryable;
+  }
+  if (error instanceof Error) {
+    const code = error.code;
+    if (code && RETRYABLE_CODES.has(code)) {
+      return true;
+    }
+    const statusCode = error.statusCode;
+    if (typeof statusCode === "number") {
+      return statusCode >= 500;
+    }
+  }
+  return false;
+}
+async function withRetry(fn, options) {
+  const opts = { ...DEFAULTS, ...options };
+  let lastError;
+  for (let attempt = 0; attempt <= opts.maxRetries; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (attempt >= opts.maxRetries || !isRetryable(error)) {
+        throw error;
+      }
+      const exponentialDelay = opts.baseDelayMs * 2 ** attempt;
+      const jitter = Math.random() * opts.baseDelayMs;
+      const delay = Math.min(exponentialDelay + jitter, opts.maxDelayMs);
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
   }
-  const expiresAt = new Date(Date.now() + CONFIRMATION_TTL_MS).toISOString();
-  const paramHash = computeParamHash(params);
-  const token = computeToken(toolName, routerId, identity.id, paramHash, expiresAt, secret);
-  pendingConfirmations.set(token, {
-    expiresAt: new Date(expiresAt),
-    tool: toolName,
-    routerId,
-    identityId: identity.id,
-    paramHash
-  });
-  throw new MikroMCPError({
-    category: "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */,
-    code: "CONFIRMATION_REQUIRED",
-    message: "This action is destructive. Re-submit with confirmationToken to proceed.",
-    details: {
-      confirmationToken: token,
-      expiresAt,
-      tool: toolName,
-      routerId
-    },
-    recoverability: {
-      retryable: true,
-      suggestedAction: "Re-submit the exact same tool call with the confirmationToken from details.confirmationToken."
-    }
-  });
+  throw lastError;
 }
 
 // src/config/maintenance-window.ts
@@ -8058,12 +8634,355 @@ function isWithinMaintenanceWindow(windows, now) {
   });
 }
 
+// src/mcp/response-formatter.ts
+function formatToolResult(result) {
+  return {
+    content: [{ type: "text", text: result.content }],
+    structuredContent: result.structuredContent,
+    ...result.isError ? { isError: true } : {}
+  };
+}
+function formatError(error) {
+  const hint = error.recoverability.suggestedAction;
+  const text = `Error [${error.category}]: ${error.message}${hint ? `
+Suggested action: ${hint}` : ""}`;
+  return {
+    content: [{ type: "text", text }],
+    structuredContent: error.toJSON(),
+    isError: true
+  };
+}
+
+// src/observability/metrics.ts
+var toolCalls = /* @__PURE__ */ new Map();
+function key(tool, status) {
+  return `${tool}\0${status}`;
+}
+function recordToolCall(tool, status) {
+  const k = key(tool, status);
+  toolCalls.set(k, (toolCalls.get(k) ?? 0) + 1);
+}
+function renderPrometheus() {
+  const lines = [
+    "# HELP mikromcp_tool_calls_total Total MCP tool calls by tool and status.",
+    "# TYPE mikromcp_tool_calls_total counter"
+  ];
+  for (const [k, count] of toolCalls) {
+    const [tool, status] = k.split("\0");
+    lines.push(`mikromcp_tool_calls_total{tool="${tool}",status="${status}"} ${count}`);
+  }
+  return lines.join("\n") + "\n";
+}
+
+// src/adapter/circuit-breaker.ts
+var TRANSIENT_CATEGORIES = /* @__PURE__ */ new Set([
+  "ROUTER_UNREACHABLE" /* ROUTER_UNREACHABLE */,
+  "ROUTER_TIMEOUT" /* ROUTER_TIMEOUT */,
+  "ROUTER_ERROR" /* ROUTER_ERROR */,
+  "ROUTER_BUSY" /* ROUTER_BUSY */
+]);
+function isTransientFailure(error) {
+  if (!(error instanceof MikroMCPError)) {
+    return false;
+  }
+  return TRANSIENT_CATEGORIES.has(error.category);
+}
+var DEFAULTS2 = {
+  failureThreshold: 5,
+  cooldownMs: 3e4
+};
+var CircuitBreaker = class {
+  constructor(routerId, options) {
+    this.routerId = routerId;
+    this.options = { ...DEFAULTS2, ...options };
+  }
+  routerId;
+  options;
+  currentState = "closed";
+  consecutiveFailures = 0;
+  lastFailureTime = 0;
+  probeInFlight = false;
+  get state() {
+    if (this.currentState === "open") {
+      const elapsed = Date.now() - this.lastFailureTime;
+      if (elapsed >= this.options.cooldownMs) {
+        this.currentState = "half-open";
+      }
+    }
+    return this.currentState;
+  }
+  /**
+   * Execute `fn` through the circuit breaker.
+   *
+   * - **closed**: execute normally; track consecutive failures.
+   * - **open**: reject immediately with `ROUTER_BUSY`.
+   * - **half-open**: execute as a probe; success closes, failure reopens.
+   */
+  async execute(fn) {
+    const currentState = this.state;
+    if (currentState === "open") {
+      throw new MikroMCPError({
+        category: "ROUTER_BUSY" /* ROUTER_BUSY */,
+        code: "CIRCUIT_OPEN",
+        message: `Circuit breaker is open for router "${this.routerId}". Try again after cooldown.`,
+        details: {
+          routerId: this.routerId,
+          consecutiveFailures: this.consecutiveFailures,
+          cooldownMs: this.options.cooldownMs
+        },
+        recoverability: {
+          retryable: true,
+          retryAfterMs: this.options.cooldownMs,
+          suggestedAction: "Wait for the circuit breaker cooldown period to expire, then retry."
+        }
+      });
+    }
+    if (currentState === "half-open") {
+      if (this.probeInFlight) {
+        throw new MikroMCPError({
+          category: "ROUTER_BUSY" /* ROUTER_BUSY */,
+          code: "CIRCUIT_PROBE_IN_FLIGHT",
+          message: `Circuit breaker for router "${this.routerId}" is half-open and a recovery probe is already in flight.`,
+          details: { routerId: this.routerId },
+          recoverability: {
+            retryable: true,
+            retryAfterMs: 1e3,
+            suggestedAction: "Wait for the in-flight probe to complete, then retry."
+          }
+        });
+      }
+      this.probeInFlight = true;
+    }
+    try {
+      const result = await fn();
+      this.onSuccess();
+      return result;
+    } catch (error) {
+      if (isTransientFailure(error)) {
+        this.onFailure();
+      }
+      throw error;
+    } finally {
+      this.probeInFlight = false;
+    }
+  }
+  /** Force the circuit back to the closed state. */
+  reset() {
+    this.currentState = "closed";
+    this.consecutiveFailures = 0;
+    this.lastFailureTime = 0;
+    this.probeInFlight = false;
+  }
+  // ---------- internal helpers ----------
+  onSuccess() {
+    this.consecutiveFailures = 0;
+    this.currentState = "closed";
+  }
+  onFailure() {
+    this.consecutiveFailures++;
+    this.lastFailureTime = Date.now();
+    if (this.currentState === "half-open") {
+      this.currentState = "open";
+    } else if (this.consecutiveFailures >= this.options.failureThreshold) {
+      this.currentState = "open";
+    }
+  }
+};
+
+// src/mcp/tool-executor.ts
+var log38 = createLogger("tool-executor");
+async function executeToolCall(tool, args, deps) {
+  const { registry, pool, circuitBreakers, config, identityRegistry } = deps;
+  const correlationId = nanoid4();
+  return withContext({ correlationId, tool: tool.name }, async () => {
+    const startMs = Date.now();
+    let journalId;
+    try {
+      const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
+      if (tool.skipRouterContext) {
+        const fleetContext = {
+          routerClient: null,
+          routerId: "",
+          correlationId,
+          routerConfig: null,
+          sshClient: null,
+          ftpClient: null,
+          identity,
+          routerRegistry: registry,
+          connectionPool: pool,
+          appConfig: config
+        };
+        const fleetResult = await tool.handler(args, fleetContext);
+        recordToolCall(tool.name, "success");
+        return formatToolResult(fleetResult);
+      }
+      const routerId = args.routerId;
+      if (!routerId) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: "MISSING_ROUTER_ID",
+          message: "routerId is required",
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Provide a valid routerId parameter."
+          }
+        });
+      }
+      checkAuthz(identity, tool.name, routerId);
+      const routerConfig = registry.getRouter(routerId);
+      if (tool.annotations.destructiveHint) {
+        const windows = routerConfig.maintenanceWindows;
+        if (windows && windows.length > 0 && !isWithinMaintenanceWindow(windows, /* @__PURE__ */ new Date())) {
+          throw new MikroMCPError({
+            category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
+            code: "OUTSIDE_MAINTENANCE_WINDOW",
+            message: `Router "${routerId}" has maintenance windows configured. Destructive operations are only permitted during scheduled windows.`,
+            details: { maintenanceWindows: windows },
+            recoverability: {
+              retryable: true,
+              suggestedAction: "Wait for a scheduled maintenance window, or remove maintenanceWindows from routers.yaml to allow unrestricted access."
+            }
+          });
+        }
+      }
+      if (tool.annotations.destructiveHint && config.confirmationSecret) {
+        await checkConfirmation(tool.name, routerId, args, identity, config.confirmationSecret);
+      }
+      const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
+      if (shouldAudit) {
+        auditLog({
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId,
+          identityId: identity.id,
+          role: identity.role,
+          tool: tool.name,
+          routerId,
+          phase: "attempt",
+          params: args
+        }, config.auditLogPath);
+      }
+      const toolContext = buildRouterToolContext({
+        routerConfig,
+        correlationId,
+        identity,
+        pool,
+        config,
+        registry
+      });
+      let cb = circuitBreakers.get(routerId);
+      if (!cb) {
+        cb = new CircuitBreaker(routerId, {
+          failureThreshold: config.circuitBreaker.failureThreshold,
+          cooldownMs: config.circuitBreaker.cooldownMs
+        });
+        circuitBreakers.set(routerId, cb);
+      }
+      toolContext.circuitBreaker = cb;
+      const { confirmationToken: _ct, ...handlerArgs } = args;
+      const snapshotIds = [];
+      if (tool.snapshotPaths && tool.snapshotPaths.length > 0 && !tool.annotations.readOnlyHint) {
+        for (const path of tool.snapshotPaths) {
+          try {
+            const meta = await takeSnapshot(toolContext.routerClient, routerId, path, config.snapshotDir);
+            snapshotIds.push(meta.id);
+            log38.debug({ snapshotId: meta.id, path }, "Snapshot taken");
+          } catch (err) {
+            log38.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
+          }
+        }
+      }
+      if (!tool.annotations.readOnlyHint && config.journalPath) {
+        journalId = recordAttempt({
+          journalPath: config.journalPath,
+          identityId: identity.id,
+          role: identity.role,
+          tool: tool.name,
+          routerId,
+          params: handlerArgs,
+          snapshotIds
+        });
+      }
+      const runHandler = () => tool.handler(handlerArgs, toolContext);
+      const executeHandler = () => cb.execute(
+        tool.annotations.readOnlyHint ? () => withRetry(runHandler, config.retry) : runHandler
+      );
+      const result = await executeHandler();
+      if (journalId) {
+        recordOutcome({
+          journalPath: config.journalPath,
+          journalId,
+          phase: "success",
+          durationMs: Date.now() - startMs
+        });
+      }
+      if (shouldAudit) {
+        auditLog({
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId,
+          identityId: identity.id,
+          role: identity.role,
+          tool: tool.name,
+          routerId,
+          phase: "success",
+          params: args,
+          durationMs: Date.now() - startMs
+        }, config.auditLogPath);
+      }
+      log38.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
+      recordToolCall(tool.name, "success");
+      return formatToolResult(result);
+    } catch (err) {
+      const error = err instanceof MikroMCPError ? err : enrichError(err, { tool: tool.name });
+      if (error.category === "ROUTER_AUTH_FAILED" /* ROUTER_AUTH_FAILED */) {
+        const failedRouterId = args.routerId;
+        if (failedRouterId) {
+          pool.removeClient(failedRouterId);
+          log38.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
+        }
+      }
+      if (journalId) {
+        recordOutcome({
+          journalPath: config.journalPath,
+          journalId,
+          phase: "failure",
+          outcome: error.code,
+          durationMs: Date.now() - startMs
+        });
+      }
+      const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
+      if (shouldAudit && error.category !== "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */) {
+        const routerId = args.routerId ?? "unknown";
+        const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
+        auditLog({
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId,
+          identityId: identity.id,
+          role: identity.role,
+          tool: tool.name,
+          routerId,
+          phase: "failure",
+          params: args,
+          outcome: error.code,
+          durationMs: Date.now() - startMs
+        }, config.auditLogPath);
+      }
+      log38.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
+      recordToolCall(tool.name, "error");
+      return formatError(error);
+    }
+  });
+}
+
 // src/mcp/tool-registry.ts
-var log34 = createLogger("tool-registry");
+var log39 = createLogger("tool-registry");
 function registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry) {
+  const deps = { registry, pool, circuitBreakers, config, identityRegistry };
   for (const tool of allTools) {
     const registrationSchema = tool.annotations.destructiveHint ? tool.inputSchema.extend({
-      confirmationToken: z32.string().optional().describe(
+      confirmationToken: z36.string().optional().describe(
         "Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action."
       )
     }) : tool.inputSchema;
@@ -8075,236 +8994,61 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
         inputSchema: registrationSchema,
         annotations: tool.annotations
       },
-      async (args) => {
-        const correlationId = nanoid4();
-        return withContext({ correlationId, tool: tool.name }, async () => {
-          const startMs = Date.now();
-          let journalId;
-          try {
-            const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
-            if (tool.skipRouterContext) {
-              const fleetContext = {
-                routerClient: null,
-                routerId: "",
-                correlationId,
-                routerConfig: null,
-                sshClient: null,
-                ftpClient: null,
-                identity,
-                routerRegistry: registry,
-                connectionPool: pool
-              };
-              return formatToolResult(await tool.handler(args, fleetContext));
-            }
-            const routerId = args.routerId;
-            if (!routerId) {
-              throw new MikroMCPError({
-                category: "VALIDATION" /* VALIDATION */,
-                code: "MISSING_ROUTER_ID",
-                message: "routerId is required",
-                recoverability: {
-                  retryable: false,
-                  suggestedAction: "Provide a valid routerId parameter."
-                }
-              });
-            }
-            checkAuthz(identity, tool.name, routerId);
-            const routerConfig = registry.getRouter(routerId);
-            if (tool.annotations.destructiveHint) {
-              const windows = routerConfig.maintenanceWindows;
-              if (windows && windows.length > 0 && !isWithinMaintenanceWindow(windows, /* @__PURE__ */ new Date())) {
-                throw new MikroMCPError({
-                  category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
-                  code: "OUTSIDE_MAINTENANCE_WINDOW",
-                  message: `Router "${routerId}" has maintenance windows configured. Destructive operations are only permitted during scheduled windows.`,
-                  details: { maintenanceWindows: windows },
-                  recoverability: {
-                    retryable: true,
-                    suggestedAction: "Wait for a scheduled maintenance window, or remove maintenanceWindows from routers.yaml to allow unrestricted access."
-                  }
-                });
-              }
-            }
-            if (tool.annotations.destructiveHint && config.confirmationSecret) {
-              await checkConfirmation(tool.name, routerId, args, identity, config.confirmationSecret);
-            }
-            const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
-            if (shouldAudit) {
-              auditLog({
-                type: "audit",
-                ts: (/* @__PURE__ */ new Date()).toISOString(),
-                correlationId,
-                identityId: identity.id,
-                role: identity.role,
-                tool: tool.name,
-                routerId,
-                phase: "attempt",
-                params: args
-              });
-            }
-            const credentials = getCredentials(routerConfig);
-            const client = pool.getClient(routerConfig, credentials);
-            const sshClient = createSshClient(routerConfig, config.ssh);
-            const ftpClient = createFtpClient(routerConfig);
-            let cb = circuitBreakers.get(routerId);
-            if (!cb) {
-              cb = new CircuitBreaker(routerId, {
-                failureThreshold: config.circuitBreaker.failureThreshold,
-                cooldownMs: config.circuitBreaker.cooldownMs
-              });
-              circuitBreakers.set(routerId, cb);
-            }
-            const { confirmationToken: _ct, ...handlerArgs } = args;
-            const snapshotIds = [];
-            if (tool.snapshotPaths && tool.snapshotPaths.length > 0 && !tool.annotations.readOnlyHint) {
-              for (const path of tool.snapshotPaths) {
-                try {
-                  const meta = await takeSnapshot(client, routerId, path, config.snapshotDir);
-                  snapshotIds.push(meta.id);
-                  log34.debug({ snapshotId: meta.id, path }, "Snapshot taken");
-                } catch (err) {
-                  log34.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
-                }
-              }
-            }
-            if (!tool.annotations.readOnlyHint && config.journalPath) {
-              journalId = recordAttempt({
-                journalPath: config.journalPath,
-                identityId: identity.id,
-                role: identity.role,
-                tool: tool.name,
-                routerId,
-                params: handlerArgs,
-                snapshotIds
-              });
-            }
-            const runHandler = () => tool.handler(handlerArgs, {
-              routerClient: client,
-              routerId,
-              correlationId,
-              routerConfig,
-              sshClient,
-              ftpClient,
-              identity,
-              routerRegistry: registry,
-              connectionPool: pool
-            });
-            const executeHandler = () => cb.execute(
-              tool.annotations.readOnlyHint ? () => withRetry(runHandler, config.retry) : runHandler
-            );
-            const result = await executeHandler();
-            if (journalId) {
-              recordOutcome({
-                journalPath: config.journalPath,
-                journalId,
-                phase: "success",
-                durationMs: Date.now() - startMs
-              });
-            }
-            if (shouldAudit) {
-              auditLog({
-                type: "audit",
-                ts: (/* @__PURE__ */ new Date()).toISOString(),
-                correlationId,
-                identityId: identity.id,
-                role: identity.role,
-                tool: tool.name,
-                routerId,
-                phase: "success",
-                params: args,
-                durationMs: Date.now() - startMs
-              });
-            }
-            log34.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
-            return formatToolResult(result);
-          } catch (err) {
-            const error = err instanceof MikroMCPError ? err : enrichError(err, { tool: tool.name });
-            if (journalId) {
-              recordOutcome({
-                journalPath: config.journalPath,
-                journalId,
-                phase: "failure",
-                outcome: error.code,
-                durationMs: Date.now() - startMs
-              });
-            }
-            const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
-            if (shouldAudit && error.category !== "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */) {
-              const routerId = args.routerId ?? "unknown";
-              const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
-              auditLog({
-                type: "audit",
-                ts: (/* @__PURE__ */ new Date()).toISOString(),
-                correlationId,
-                identityId: identity.id,
-                role: identity.role,
-                tool: tool.name,
-                routerId,
-                phase: "failure",
-                params: args,
-                outcome: error.code,
-                durationMs: Date.now() - startMs
-              });
-            }
-            log34.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
-            return formatError(error);
-          }
-        });
-      }
+      (args) => executeToolCall(tool, args, deps)
     );
-    log34.debug({ tool: tool.name }, "Registered tool");
+    log39.debug({ tool: tool.name }, "Registered tool");
   }
-  log34.info({ count: allTools.length }, "All tools registered");
+  log39.info({ count: allTools.length }, "All tools registered");
 }
 
 // src/config/router-registry.ts
-import { readFileSync as readFileSync3, existsSync } from "fs";
+import { readFileSync as readFileSync2, existsSync } from "fs";
 import { parse } from "yaml";
-import { z as z33 } from "zod";
-var log35 = createLogger("router-registry");
-var RouterConfigSchema = z33.object({
-  host: z33.string().min(1, "host is required"),
-  port: z33.number().int().min(1).max(65535),
-  tls: z33.object({
-    enabled: z33.boolean(),
-    rejectUnauthorized: z33.boolean(),
-    ca: z33.string().optional(),
-    fingerprint: z33.string().optional()
+import { z as z37 } from "zod";
+var log40 = createLogger("router-registry");
+var RouterConfigSchema = z37.object({
+  host: z37.string().min(1, "host is required"),
+  port: z37.number().int().min(1).max(65535),
+  tls: z37.object({
+    enabled: z37.boolean(),
+    rejectUnauthorized: z37.boolean(),
+    ca: z37.string().optional(),
+    fingerprint: z37.string().optional()
   }).strict(),
-  credentials: z33.object({
-    source: z33.enum(["env", "vault"]),
-    envPrefix: z33.string().optional(),
-    vaultPath: z33.string().optional()
+  credentials: z37.object({
+    source: z37.enum(["env", "vault"]),
+    envPrefix: z37.string().optional(),
+    vaultPath: z37.string().optional()
   }).strict(),
-  tags: z33.array(z33.string()).default([]),
-  rosVersion: z33.string().min(1),
-  sshPort: z33.number().int().min(1).max(65535).optional(),
-  sshFingerprint: z33.string().optional(),
-  cmdAllow: z33.array(z33.string()).optional(),
-  cmdDeny: z33.array(z33.string()).optional(),
-  maintenanceWindows: z33.array(
-    z33.object({
-      days: z33.array(
-        z33.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
+  tags: z37.array(z37.string()).default([]),
+  rosVersion: z37.string().min(1),
+  sshPort: z37.number().int().min(1).max(65535).optional(),
+  sshFingerprint: z37.string().optional(),
+  cmdAllow: z37.array(z37.string()).optional(),
+  cmdDeny: z37.array(z37.string()).optional(),
+  maintenanceWindows: z37.array(
+    z37.object({
+      days: z37.array(
+        z37.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
       ),
-      startTime: z33.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
-      endTime: z33.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
-      timezone: z33.string().min(1)
+      startTime: z37.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
+      endTime: z37.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
+      timezone: z37.string().min(1)
     }).strict()
   ).optional()
 }).strict();
-var ConfigFileSchema = z33.object({
-  routers: z33.record(z33.string(), RouterConfigSchema)
+var ConfigFileSchema = z37.object({
+  routers: z37.record(z37.string(), RouterConfigSchema)
 }).strict();
 var RouterRegistry = class {
   routers;
   constructor(configPath) {
     this.routers = /* @__PURE__ */ new Map();
     if (!existsSync(configPath)) {
-      log35.warn({ configPath }, "Router config file not found; starting with empty registry");
+      log40.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
-    const raw = readFileSync3(configPath, "utf-8");
+    const raw = readFileSync2(configPath, "utf-8");
     const parsed = parse(raw);
     const result = ConfigFileSchema.safeParse(parsed);
     if (!result.success) {
@@ -8315,14 +9059,14 @@ ${issues}`);
     for (const [id, config] of Object.entries(result.data.routers)) {
       const routerConfig = { ...config, id };
       if (routerConfig.tls.enabled && !routerConfig.tls.rejectUnauthorized) {
-        log35.warn(
+        log40.warn(
           { routerId: id },
           "TLS certificate validation is DISABLED (rejectUnauthorized=false). Set tls.fingerprint to pin the server certificate instead."
         );
       }
       this.routers.set(id, routerConfig);
     }
-    log35.info({ count: this.routers.size }, "Loaded routers from config");
+    log40.info({ count: this.routers.size }, "Loaded routers from config");
   }
   getRouter(id) {
     const router = this.routers.get(id);
@@ -8345,7 +9089,7 @@ ${issues}`);
 import { request, Agent } from "undici";
 
 // src/adapter/tls-manager.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 function buildAgentOptions(tls) {
   if (!tls.enabled) {
     return {};
@@ -8354,7 +9098,7 @@ function buildAgentOptions(tls) {
     rejectUnauthorized: tls.rejectUnauthorized
   };
   if (tls.ca) {
-    connectOptions.ca = readFileSync4(tls.ca, "utf-8");
+    connectOptions.ca = readFileSync3(tls.ca, "utf-8");
   }
   if (tls.fingerprint) {
     const expected = tls.fingerprint.replace(/:/g, "").toLowerCase();
@@ -8376,8 +9120,8 @@ function buildAgentOptions(tls) {
 // src/adapter/response-parser.ts
 var NUMERIC_RE = /^-?\d+(\.\d+)?$/;
 var DURATION_RE = /^\d+[wdhms](\d+[wdhms])*$/;
-function parseRouterOSValue(key, value) {
-  if (key === ".id") {
+function parseRouterOSValue(key2, value) {
+  if (key2 === ".id") {
     return value;
   }
   if (value === "true") return true;
@@ -8395,8 +9139,8 @@ function parseRouterOSValue(key, value) {
 }
 function parseRecord(raw) {
   const parsed = {};
-  for (const [key, value] of Object.entries(raw)) {
-    parsed[key] = parseRouterOSValue(key, value);
+  for (const [key2, value] of Object.entries(raw)) {
+    parsed[key2] = parseRouterOSValue(key2, value);
   }
   return parsed;
 }
@@ -8418,8 +9162,8 @@ function buildListQuery(options) {
     }
     if (hasFilter) {
       const queryParts = [];
-      for (const [key, value] of Object.entries(options.filter)) {
-        queryParts.push(`${key}=${value}`);
+      for (const [key2, value] of Object.entries(options.filter)) {
+        queryParts.push(`${key2}=${value}`);
       }
       body[".query"] = queryParts;
     }
@@ -8427,8 +9171,8 @@ function buildListQuery(options) {
   }
   if (hasFilter) {
     const queryParams = {};
-    for (const [key, value] of Object.entries(options.filter)) {
-      queryParams[key] = value;
+    for (const [key2, value] of Object.entries(options.filter)) {
+      queryParams[key2] = value;
     }
     return { method: "GET", queryParams };
   }
@@ -8606,6 +9350,9 @@ var ConnectionPool = class {
   }
 };
 
+// src/version.ts
+var VERSION = "1.2.0";
+
 // src/mcp/server.ts
 function createServerFactory(config, identityRegistry) {
   const registry = new RouterRegistry(config.configPath);
@@ -8614,7 +9361,7 @@ function createServerFactory(config, identityRegistry) {
   const makeServer = () => {
     const server = new McpServer({
       name: "mikromcp",
-      version: "1.0.10"
+      version: VERSION
     });
     registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry);
     return server;
@@ -8634,17 +9381,17 @@ import { randomUUID } from "crypto";
 import { createServer } from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-var log36 = createLogger("transport-http");
+var log41 = createLogger("transport-http");
 var BodyTooLargeError = class extends Error {
   constructor() {
     super("Request body exceeds maximum allowed size");
   }
 };
 function createRateLimiter(rpm) {
-  if (rpm === 0) return () => true;
   const WINDOW_MS = 6e4;
   const windows = /* @__PURE__ */ new Map();
-  return (ip) => {
+  const check = (ip) => {
+    if (rpm === 0) return true;
     const now = Date.now();
     const entry = windows.get(ip);
     if (!entry || now - entry.windowStart >= WINDOW_MS) {
@@ -8657,6 +9404,17 @@ function createRateLimiter(rpm) {
     entry.count++;
     return true;
   };
+  const limiter = check;
+  limiter.sweep = () => {
+    const now = Date.now();
+    for (const [ip, entry] of windows) {
+      if (now - entry.windowStart >= WINDOW_MS) {
+        windows.delete(ip);
+      }
+    }
+  };
+  limiter.size = () => windows.size;
+  return limiter;
 }
 async function readBody(req, maxBytes) {
   return new Promise((resolve, reject) => {
@@ -8696,18 +9454,30 @@ async function readBody(req, maxBytes) {
 async function connectHttp(makeServer, config, identityRegistry) {
   const { port, bindHost, maxBodyBytes, rateLimitRpm } = config;
   const checkRateLimit = createRateLimiter(rateLimitRpm);
+  const sweepTimer = setInterval(() => checkRateLimit.sweep(), 6e4);
+  sweepTimer.unref();
   const streamableSessions = /* @__PURE__ */ new Map();
   const sseTransports = /* @__PURE__ */ new Map();
   const httpServer = createServer(async (req, res) => {
     const ip = req.socket.remoteAddress ?? "unknown";
+    const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+    const { pathname } = url;
+    if (pathname === "/healthz") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ status: "ok" }));
+      return;
+    }
+    if (pathname === "/metrics") {
+      res.writeHead(200, { "Content-Type": "text/plain; version=0.0.4; charset=utf-8" });
+      res.end(renderPrometheus());
+      return;
+    }
     if (!checkRateLimit(ip)) {
-      log36.warn({ ip }, "Rate limit exceeded");
+      log41.warn({ ip }, "Rate limit exceeded");
       res.writeHead(429, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Too many requests. Retry after 60 seconds." }));
       return;
     }
-    const url = new URL(req.url ?? "/", `http://localhost:${port}`);
-    const { pathname } = url;
     try {
       if (pathname === "/mcp" || pathname === "/sse" || pathname === "/messages") {
         let identity;
@@ -8744,16 +9514,17 @@ async function connectHttp(makeServer, config, identityRegistry) {
         }
         return;
       }
-      log36.error({ err }, "HTTP transport error");
+      log41.error({ err }, "HTTP transport error");
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Internal server error" }));
       }
     }
   });
+  httpServer.on("close", () => clearInterval(sweepTimer));
   await new Promise((resolve, reject) => {
     httpServer.listen(port, bindHost, () => {
-      log36.info(
+      log41.info(
         { port, bindHost },
         "HTTP transport listening (POST /mcp for Streamable HTTP, GET /sse for legacy SSE)"
       );
@@ -8761,6 +9532,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
     });
     httpServer.on("error", reject);
   });
+  return httpServer;
 }
 async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, makeServer, streamableSessions, sseTransports) {
   if (pathname === "/mcp") {
@@ -8776,13 +9548,13 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (id) => {
           streamableSessions.set(id, transport2);
-          log36.info({ sessionId: id }, "Streamable HTTP session created");
+          log41.info({ sessionId: id }, "Streamable HTTP session created");
         }
       });
       transport2.onclose = () => {
         if (transport2.sessionId) {
           streamableSessions.delete(transport2.sessionId);
-          log36.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
+          log41.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
         }
       };
       await makeServer().connect(transport2);
@@ -8799,7 +9571,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
     sseTransport.onclose = () => {
       sseTransports.delete(sseTransport.sessionId);
     };
-    log36.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
+    log41.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
     await sseTransport.start();
     return;
   }
@@ -8818,31 +9590,31 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 }
 
 // src/config/identity-registry.ts
-import { readFileSync as readFileSync5, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
 import { parse as parse2 } from "yaml";
-import { z as z34 } from "zod";
+import { z as z38 } from "zod";
 import bcrypt from "bcryptjs";
-var log37 = createLogger("identity-registry");
-var IdentityConfigSchema = z34.object({
-  token: z34.string().min(1, "token hash is required"),
-  role: z34.enum(["readonly", "operator", "admin", "superadmin"]),
-  allowedRouters: z34.array(z34.string()).default([]),
-  allowedToolPatterns: z34.array(z34.string()).default([])
+var log42 = createLogger("identity-registry");
+var IdentityConfigSchema = z38.object({
+  token: z38.string().min(1, "token hash is required"),
+  role: z38.enum(["readonly", "operator", "admin", "superadmin"]),
+  allowedRouters: z38.array(z38.string()).default([]),
+  allowedToolPatterns: z38.array(z38.string()).default([])
 }).strict();
-var ConfigFileSchema2 = z34.object({
-  identities: z34.record(z34.string(), IdentityConfigSchema)
+var ConfigFileSchema2 = z38.object({
+  identities: z38.record(z38.string(), IdentityConfigSchema)
 }).strict();
 var IdentityRegistry = class {
   identities = [];
   constructor(configPath) {
     if (!existsSync2(configPath)) {
-      log37.warn(
+      log42.warn(
         { configPath },
         "Identity config file not found; starting with empty registry (stdio callers do not require it)"
       );
       return;
     }
-    const raw = readFileSync5(configPath, "utf-8");
+    const raw = readFileSync4(configPath, "utf-8");
     const parsed = parse2(raw);
     const result = ConfigFileSchema2.safeParse(parsed);
     if (!result.success) {
@@ -8859,7 +9631,7 @@ ${issues}`);
         allowedToolPatterns: config.allowedToolPatterns
       });
     }
-    log37.info({ count: this.identities.length }, "Loaded identities from config");
+    log42.info({ count: this.identities.length }, "Loaded identities from config");
   }
   getIdentities() {
     return this.identities.map(({ id, role, allowedRouters, allowedToolPatterns }) => ({
@@ -8885,18 +9657,59 @@ ${issues}`);
   }
 };
 
+// src/domain/snapshot/retention.ts
+import { readdir, stat, unlink } from "fs/promises";
+import { join as join3 } from "path";
+var log43 = createLogger("snapshot-retention");
+async function pruneSnapshots(snapshotDir, maxAgeDays) {
+  const cutoffMs = Date.now() - maxAgeDays * 864e5;
+  let removed = 0;
+  let routerDirs;
+  try {
+    routerDirs = await readdir(snapshotDir);
+  } catch {
+    return 0;
+  }
+  for (const routerDir of routerDirs) {
+    const dirPath = join3(snapshotDir, routerDir);
+    let files;
+    try {
+      files = await readdir(dirPath);
+    } catch {
+      continue;
+    }
+    for (const file of files) {
+      const filePath = join3(dirPath, file);
+      try {
+        const info = await stat(filePath);
+        if (info.isFile() && info.mtimeMs < cutoffMs) {
+          await unlink(filePath);
+          removed++;
+        }
+      } catch (err) {
+        log43.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
+      }
+    }
+  }
+  if (removed > 0) {
+    log43.info({ removed, maxAgeDays }, "Pruned expired snapshots");
+  }
+  return removed;
+}
+
 // src/cli/serve.ts
-var log38 = createLogger("main");
+var log44 = createLogger("main");
 async function runServe() {
   const config = loadAppConfig();
-  log38.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
+  log44.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
+  void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
     const hasLimitedRoles = identityRegistry.getIdentities().some(
       (i) => i.role === "readonly" || i.role === "operator"
     );
     if (hasLimitedRoles && !config.confirmationSecret) {
-      log38.error(
+      log44.error(
         "MIKROMCP_CONFIRMATION_SECRET is required in HTTP mode when identities with role readonly or operator are configured"
       );
       process.exit(1);
@@ -8906,7 +9719,7 @@ async function runServe() {
   if (config.transport === "stdio") {
     const stdioIdentity = getStdioIdentity(config.stdioIdentity, identityRegistry);
     await withIdentity(stdioIdentity, () => connectStdio(makeServer()));
-    log38.info("MikroMCP server running via stdio");
+    log44.info("MikroMCP server running via stdio");
   } else if (config.transport === "http") {
     await connectHttp(
       makeServer,
@@ -8918,13 +9731,13 @@ async function runServe() {
       },
       identityRegistry
     );
-    log38.info(
+    log44.info(
       { port: config.port, bindHost: config.bindHost },
       "MikroMCP server running via HTTP/SSE"
     );
   }
   const shutdown = () => {
-    log38.info("Shutting down MikroMCP server");
+    log44.info("Shutting down MikroMCP server");
     pool.closeAll();
     process.exit(0);
   };
@@ -8933,11 +9746,11 @@ async function runServe() {
 }
 
 // src/cli/doctor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.0.10";
+var localVersion = "1.2.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -9117,8 +9930,8 @@ function checkIdentities(identitiesPath, transport2) {
 }
 function checkClaudeDesktop() {
   const candidatePaths = [
-    `${homedir3()}/Library/Application Support/Claude/claude_desktop_config.json`,
-    `${homedir3()}/.config/Claude/claude_desktop_config.json`
+    `${homedir2()}/Library/Application Support/Claude/claude_desktop_config.json`,
+    `${homedir2()}/.config/Claude/claude_desktop_config.json`
   ];
   const configPath = candidatePaths.find((p) => existsSync3(p));
   if (!configPath) {
@@ -9126,7 +9939,7 @@ function checkClaudeDesktop() {
     return;
   }
   try {
-    const raw = readFileSync6(configPath, "utf-8");
+    const raw = readFileSync5(configPath, "utf-8");
     const config = JSON.parse(raw);
     const servers = config.mcpServers ?? {};
     if ("mikromcp" in servers || "mikrotik-mcp-server" in servers) {
@@ -9211,18 +10024,18 @@ import { input, confirm, select } from "@inquirer/prompts";
 import { randomBytes } from "crypto";
 import {
   existsSync as existsSync4,
-  readFileSync as readFileSync7,
-  writeFileSync as writeFileSync2,
-  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync6,
+  writeFileSync,
+  mkdirSync,
   copyFileSync
 } from "fs";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
 import { parse as yamlParse, Document, visit } from "yaml";
 import bcrypt2 from "bcryptjs";
 import chalk2 from "chalk";
 function mikromcpDir2() {
-  return join4(homedir4(), ".mikromcp");
+  return join4(homedir3(), ".mikromcp");
 }
 function defaultAuditLogPath() {
   return join4(mikromcpDir2(), "audit.ndjson");
@@ -9230,8 +10043,8 @@ function defaultAuditLogPath() {
 function toYaml(obj) {
   const doc = new Document(obj);
   visit(doc, {
-    Scalar(key, node) {
-      if (key !== "key" && typeof node.value === "string") {
+    Scalar(key2, node) {
+      if (key2 !== "key" && typeof node.value === "string") {
         node.type = "QUOTE_DOUBLE";
       }
     },
@@ -9253,8 +10066,8 @@ function splitTags(val) {
 }
 function findClaudeDesktopConfig() {
   const candidates = [
-    join4(homedir4(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
-    join4(homedir4(), ".config", "Claude", "claude_desktop_config.json")
+    join4(homedir3(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+    join4(homedir3(), ".config", "Claude", "claude_desktop_config.json")
   ];
   return candidates.find((p) => existsSync4(p)) ?? null;
 }
@@ -9419,13 +10232,13 @@ function writeRoutersYaml(data) {
   };
   let parsed = { routers: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync7(filePath, "utf-8");
+    const raw = readFileSync6(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { routers: {} };
     if (!parsed.routers) parsed.routers = {};
   }
   parsed.routers[data.routerId] = newEntry;
-  mkdirSync3(data.configDir, { recursive: true });
-  writeFileSync2(filePath, toYaml(parsed));
+  mkdirSync(data.configDir, { recursive: true });
+  writeFileSync(filePath, toYaml(parsed));
   return true;
 }
 function writeIdentitiesYaml(data) {
@@ -9433,18 +10246,18 @@ function writeIdentitiesYaml(data) {
   const newEntry = {
     token: data.tokenHash,
     role: data.role,
-    allowedRouters: data.allowedRouters === "*" ? ["*"] : data.allowedRouters.split(",").map((s) => s.trim()),
-    allowedToolPatterns: data.allowedToolPatterns === "*" ? ["*"] : data.allowedToolPatterns.split(",").map((s) => s.trim())
+    allowedRouters: data.allowedRouters === "*" ? [] : data.allowedRouters.split(",").map((s) => s.trim()),
+    allowedToolPatterns: data.allowedToolPatterns === "*" ? [] : data.allowedToolPatterns.split(",").map((s) => s.trim())
   };
   let parsed = { identities: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync7(filePath, "utf-8");
+    const raw = readFileSync6(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { identities: {} };
     if (!parsed.identities) parsed.identities = {};
   }
   parsed.identities[data.identityId] = newEntry;
-  mkdirSync3(data.configDir, { recursive: true });
-  writeFileSync2(filePath, toYaml(parsed));
+  mkdirSync(data.configDir, { recursive: true });
+  writeFileSync(filePath, toYaml(parsed));
   return true;
 }
 function writeDotEnv(data) {
@@ -9478,8 +10291,8 @@ function writeDotEnv(data) {
     "# \u2500\u2500 RBAC (optional, for stdio with identity enforcement) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "# MIKROMCP_STDIO_IDENTITY="
   ];
-  mkdirSync3(data.configDir, { recursive: true });
-  writeFileSync2(data.envPath, lines.join("\n") + "\n");
+  mkdirSync(data.configDir, { recursive: true });
+  writeFileSync(data.envPath, lines.join("\n") + "\n");
 }
 function registerClaudeDesktop() {
   const configPath = findClaudeDesktopConfig();
@@ -9500,13 +10313,13 @@ function registerClaudeDesktop() {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${configPath}.backup-${timestamp}`;
   copyFileSync(configPath, backupPath);
-  const raw = readFileSync7(configPath, "utf-8");
+  const raw = readFileSync6(configPath, "utf-8");
   const config = JSON.parse(raw);
   if (!config.mcpServers || typeof config.mcpServers !== "object") {
     config.mcpServers = {};
   }
   config.mcpServers["mikromcp"] = entry;
-  writeFileSync2(configPath, JSON.stringify(config, null, 2));
+  writeFileSync(configPath, JSON.stringify(config, null, 2));
   console.log(chalk2.dim(`  Backed up to ${backupPath}`));
   console.log(chalk2.dim("  Restart Claude to apply."));
   return { registered: true };
@@ -9589,7 +10402,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.0.10");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.2.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);
@@ -9599,6 +10412,6 @@ program.command("update").description("Update mikromcp to the latest version via
 });
 
 // src/main.ts
-loadDotenv({ path: join5(homedir5(), ".mikromcp", ".env"), override: false, quiet: true });
+loadDotenv({ path: join5(homedir4(), ".mikromcp", ".env"), override: false, quiet: true });
 program.parse();
 //# sourceMappingURL=main.js.map