mikromcp 1.3.0 → 1.5.0

package/dist/main.js

@@ -60,7 +60,7 @@ function loadAppConfig() {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/tool-registry.ts
-import { z as z38 } from "zod";
+import { z as z46 } from "zod";
 
 // src/domain/tools/system-tools.ts
 import { z } from "zod";
@@ -2842,7 +2842,148 @@ var managePeerTool = {
     }
   }
 };
-var wireguardTools = [listWgTool, listPeersTool, managePeerTool];
+var manageWgIfaceInputSchema = z12.object({
+  routerId: z12.string().describe("Target router identifier from the router registry"),
+  action: z12.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z12.string().describe("Interface name \u2014 idempotency key (e.g. wg0)"),
+  listenPort: z12.number().int().min(1).max(65535).optional().describe("UDP listen port (RouterOS picks one if omitted)"),
+  mtu: z12.number().int().min(1280).max(65535).default(1420).describe("MTU (default 1420)"),
+  comment: z12.string().optional().describe("Optional comment"),
+  dryRun: z12.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageWgIfaceTool = {
+  name: "manage_wireguard_interface",
+  title: "Manage WireGuard Interface",
+  description: "Add, remove, enable, or disable a WireGuard interface. Idempotent by name. RouterOS generates the private key on create \u2014 it is never passed in. The public key is returned after creation.",
+  inputSchema: manageWgIfaceInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["interface/wireguard"],
+  async handler(params, context) {
+    const parsed = manageWgIfaceInputSchema.parse(params);
+    log11.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing WireGuard interface"
+    );
+    try {
+      const all = await context.routerClient.get("interface/wireguard", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find((i) => i.name === parsed.name);
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `WireGuard interface "${parsed.name}" already exists. No changes made.`,
+            structuredContent: {
+              action: "already_exists",
+              name: parsed.name,
+              publicKey: existing["public-key"] ?? null
+            }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would create WireGuard interface "${parsed.name}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "name", before: null, after: parsed.name }]
+            }
+          };
+        }
+        const body = { name: parsed.name, mtu: String(parsed.mtu) };
+        if (parsed.listenPort !== void 0) body["listen-port"] = String(parsed.listenPort);
+        if (parsed.comment) body.comment = parsed.comment;
+        const created = await context.routerClient.create(
+          "interface/wireguard",
+          body
+        );
+        log11.info({ name: parsed.name, id: created[".id"] }, "WireGuard interface created");
+        return {
+          content: `Created WireGuard interface "${parsed.name}". Public key: ${created["public-key"] ?? "unknown"}`,
+          structuredContent: {
+            action: "created",
+            name: parsed.name,
+            id: created[".id"],
+            publicKey: created["public-key"] ?? null
+          }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `WireGuard interface "${parsed.name}" not found. Nothing to remove.`,
+            structuredContent: { action: "not_found", name: parsed.name }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove WireGuard interface "${parsed.name}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "name", before: parsed.name, after: null }]
+            }
+          };
+        }
+        await context.routerClient.remove("interface/wireguard", existing[".id"]);
+        log11.info({ name: parsed.name }, "WireGuard interface removed");
+        return {
+          content: `Removed WireGuard interface "${parsed.name}".`,
+          structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+        };
+      }
+      if (!existing) {
+        throw new MikroMCPError({
+          category: "NOT_FOUND" /* NOT_FOUND */,
+          code: "WIREGUARD_IFACE_NOT_FOUND",
+          message: `WireGuard interface "${parsed.name}" not found.`,
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Verify with list_wireguard_interfaces.",
+            alternativeTools: ["list_wireguard_interfaces"]
+          }
+        });
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would ${parsed.action} WireGuard interface "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [
+              {
+                property: "disabled",
+                before: existing.disabled,
+                after: parsed.action === "disable" ? "true" : "false"
+              }
+            ]
+          }
+        };
+      }
+      await context.routerClient.update("interface/wireguard", existing[".id"], {
+        disabled: parsed.action === "disable" ? "true" : "false"
+      });
+      const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
+      log11.info({ name: parsed.name, action: resultAction }, "WireGuard interface updated");
+      return {
+        content: `WireGuard interface "${parsed.name}" ${resultAction}.`,
+        structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_wireguard_interface" });
+    }
+  }
+};
+var wireguardTools = [
+  listWgTool,
+  listPeersTool,
+  managePeerTool,
+  manageWgIfaceTool
+];
 
 // src/domain/tools/dns-tools.ts
 import { z as z13 } from "zod";
@@ -3081,7 +3222,89 @@ var getDnsSettingsTool = {
     }
   }
 };
-var dnsTools = [listDnsTool, manageDnsTool, getDnsSettingsTool];
+var manageDnsSettingsInputSchema = z13.object({
+  routerId: z13.string().describe("Target router identifier from the router registry"),
+  servers: z13.string().optional().describe("Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1')"),
+  allowRemoteRequests: z13.boolean().optional().describe("Allow router to answer DNS queries from the network"),
+  maxUdpPacketSize: z13.number().int().min(512).max(65535).optional().describe("Maximum UDP packet size in bytes"),
+  cacheMaxTtl: z13.string().optional().describe("Maximum cache TTL (e.g. '1d', '00:30:00')"),
+  cacheSize: z13.number().int().min(1).optional().describe("DNS cache size in KiB"),
+  dryRun: z13.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageDnsSettingsTool = {
+  name: "manage_dns_settings",
+  title: "Manage DNS Settings",
+  description: "Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.",
+  inputSchema: manageDnsSettingsInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["ip/dns"],
+  async handler(params, context) {
+    const parsed = manageDnsSettingsInputSchema.parse(params);
+    log12.info({ routerId: context.routerId }, "Managing DNS settings");
+    try {
+      const results2 = await context.routerClient.get("ip/dns");
+      const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
+      const id = current[".id"];
+      const changes = {};
+      const diff = [];
+      if (parsed.servers !== void 0 && current.servers !== parsed.servers) {
+        changes.servers = parsed.servers;
+        diff.push({ property: "servers", before: current.servers ?? null, after: parsed.servers });
+      }
+      if (parsed.allowRemoteRequests !== void 0) {
+        const next = String(parsed.allowRemoteRequests);
+        if (current["allow-remote-requests"] !== next) {
+          changes["allow-remote-requests"] = next;
+          diff.push({ property: "allow-remote-requests", before: current["allow-remote-requests"] ?? null, after: next });
+        }
+      }
+      if (parsed.maxUdpPacketSize !== void 0) {
+        const next = String(parsed.maxUdpPacketSize);
+        if (current["max-udp-packet-size"] !== next) {
+          changes["max-udp-packet-size"] = next;
+          diff.push({ property: "max-udp-packet-size", before: current["max-udp-packet-size"] ?? null, after: next });
+        }
+      }
+      if (parsed.cacheMaxTtl !== void 0 && current["cache-max-ttl"] !== parsed.cacheMaxTtl) {
+        changes["cache-max-ttl"] = parsed.cacheMaxTtl;
+        diff.push({ property: "cache-max-ttl", before: current["cache-max-ttl"] ?? null, after: parsed.cacheMaxTtl });
+      }
+      if (parsed.cacheSize !== void 0) {
+        const next = String(parsed.cacheSize);
+        if (current["cache-size"] !== next) {
+          changes["cache-size"] = next;
+          diff.push({ property: "cache-size", before: current["cache-size"] ?? null, after: next });
+        }
+      }
+      if (Object.keys(changes).length === 0) {
+        return {
+          content: "DNS settings already match requested values. No changes made.",
+          structuredContent: { action: "no_change", routerId: context.routerId }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would update DNS settings on ${context.routerId}.`,
+          structuredContent: { action: "dry_run", diff }
+        };
+      }
+      await context.routerClient.update("ip/dns", id, changes);
+      log12.info({ routerId: context.routerId, changes: Object.keys(changes) }, "DNS settings updated");
+      return {
+        content: `Updated DNS settings on ${context.routerId}.`,
+        structuredContent: { action: "updated", routerId: context.routerId, diff }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_dns_settings" });
+    }
+  }
+};
+var dnsTools = [listDnsTool, manageDnsTool, getDnsSettingsTool, manageDnsSettingsTool];
 
 // src/domain/tools/mangle-tools.ts
 import { z as z14 } from "zod";
@@ -4689,7 +4912,71 @@ var uploadFileTool = {
     }
   }
 };
-var filesTools = [listFilesTool, getFileContentTool, uploadFileTool];
+var deleteFileInputSchema = z21.object({
+  routerId: z21.string().describe("Target router identifier from the router registry"),
+  name: z21.string().describe("Exact file name on the router (e.g. flash/backup.backup)"),
+  dryRun: z21.boolean().default(false).describe("Preview deletion without removing the file")
+}).strict();
+var deleteFileTool = {
+  name: "delete_file",
+  title: "Delete File",
+  description: "Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.",
+  inputSchema: deleteFileInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = deleteFileInputSchema.parse(params);
+    log20.info({ routerId: context.routerId, name: parsed.name }, "Deleting file");
+    try {
+      const all = await context.routerClient.get(FILE_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const file = all.find((f) => f.name === parsed.name);
+      if (!file) {
+        return {
+          content: `File "${parsed.name}" not found on ${context.routerId}. Nothing to delete.`,
+          structuredContent: { action: "not_found", name: parsed.name, routerId: context.routerId }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would delete "${parsed.name}" from ${context.routerId}.`,
+          structuredContent: {
+            action: "dry_run",
+            name: parsed.name,
+            id: file[".id"],
+            routerId: context.routerId
+          }
+        };
+      }
+      await context.routerClient.remove(FILE_PATH, file[".id"]);
+      log20.info({ name: parsed.name, id: file[".id"] }, "File deleted");
+      return {
+        content: `Deleted "${parsed.name}" from ${context.routerId}.`,
+        structuredContent: {
+          action: "deleted",
+          name: parsed.name,
+          id: file[".id"],
+          routerId: context.routerId
+        }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "delete_file" });
+    }
+  }
+};
+var filesTools = [
+  listFilesTool,
+  getFileContentTool,
+  uploadFileTool,
+  deleteFileTool
+];
 
 // src/domain/tools/container-tools.ts
 import { z as z22 } from "zod";
@@ -5603,91 +5890,244 @@ var manageIpsecPeerTool = {
     }
   }
 };
-var ipsecTools = [
-  listIpsecPeersTool,
-  listIpsecPoliciesTool,
-  manageIpsecPeerTool
-];
-
-// src/domain/tools/certificate-tools.ts
-import { z as z25 } from "zod";
-var log26 = createLogger("certificate-tools");
-var listCertificatesInputSchema = z25.object({
-  routerId: z25.string().describe("Target router identifier from the router registry"),
-  name: z25.string().optional().describe("Filter by certificate name (substring match)"),
-  expired: z25.boolean().optional().describe("Filter by expiry status; omit to return all"),
-  limit: z25.number().int().min(1).max(500).default(100).describe("Maximum number of certificates to return")
+var manageIpsecPolicyInputSchema = z24.object({
+  routerId: z24.string().describe("Target router identifier from the router registry"),
+  action: z24.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  srcAddress: z24.string().describe("Source CIDR \u2014 part of composite idempotency key"),
+  dstAddress: z24.string().describe("Destination CIDR \u2014 part of composite idempotency key"),
+  tunnel: z24.boolean().default(false).describe("Tunnel mode \u2014 part of composite idempotency key"),
+  ipsecAction: z24.enum(["encrypt", "discard", "none"]).optional().describe("IPSec action (required for add)"),
+  level: z24.enum(["require", "use", "unique"]).default("require").describe("SA level"),
+  saSourceAddress: z24.string().optional().describe("SA source IP for tunnel mode"),
+  saDstAddress: z24.string().optional().describe("SA destination IP for tunnel mode"),
+  dryRun: z24.boolean().default(false).describe("Preview changes without applying")
 }).strict();
-var listCertificatesTool = {
-  name: "list_certificates",
-  title: "List Certificates",
-  description: "List certificates on a MikroTik router.",
-  inputSchema: listCertificatesInputSchema,
+var manageIpsecPolicyTool = {
+  name: "manage_ipsec_policy",
+  title: "Manage IPSec Policy",
+  description: "Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).",
+  inputSchema: manageIpsecPolicyInputSchema,
   annotations: {
-    readOnlyHint: true,
+    readOnlyHint: false,
     destructiveHint: false,
     idempotentHint: true,
     openWorldHint: false
   },
+  snapshotPaths: ["ip/ipsec/policy"],
   async handler(params, context) {
-    const parsed = listCertificatesInputSchema.parse(params);
-    log26.info({ routerId: context.routerId }, "Listing certificates");
+    const parsed = manageIpsecPolicyInputSchema.parse(params);
+    log25.info({ routerId: context.routerId, action: parsed.action }, "Managing IPSec policy");
     try {
-      const allCerts = await context.routerClient.get("certificate", {
+      const all = await context.routerClient.get("ip/ipsec/policy", {
         limit: void 0,
         offset: void 0
       });
-      const now = /* @__PURE__ */ new Date();
-      const filtered = allCerts.filter((c) => parsed.name ? (c.name ?? "").includes(parsed.name) : true).filter((c) => {
-        if (parsed.expired === void 0) return true;
-        const invalidAfter = c["invalid-after"];
-        if (!invalidAfter) {
-          return parsed.expired === true;
+      const tunnelStr = String(parsed.tunnel);
+      const existing = all.find(
+        (p) => p["src-address"] === parsed.srcAddress && p["dst-address"] === parsed.dstAddress && p.tunnel === tunnelStr
+      );
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress} already exists. No changes made.`,
+            structuredContent: { action: "already_exists", policy: existing }
+          };
         }
-        const expiry = new Date(invalidAfter);
-        return parsed.expired ? expiry < now : expiry >= now;
-      });
-      const certs = filtered.slice(0, parsed.limit);
-      return {
-        content: `Certificates on ${context.routerId}: ${certs.length} returned (${allCerts.length} total)`,
-        structuredContent: {
-          routerId: context.routerId,
-          certificates: certs,
-          total: allCerts.length,
-          returned: certs.length
+        if (!parsed.ipsecAction) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "IPSEC_POLICY_ACTION_REQUIRED",
+            message: "ipsecAction is required when adding an IPSec policy.",
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide ipsecAction: encrypt, discard, or none."
+            }
+          });
         }
-      };
-    } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_certificates" });
-    }
-  }
-};
-var manageCertificateInputSchema = z25.object({
-  routerId: z25.string().describe("Target router identifier from the router registry"),
-  action: z25.enum(["remove", "trust", "untrust"]).describe("Action to perform"),
-  name: z25.string().describe("Certificate name \u2014 idempotency key"),
-  dryRun: z25.boolean().default(false).describe("Preview changes without applying")
-}).strict();
-var manageCertificateTool = {
-  name: "manage_certificate",
-  title: "Manage Certificate",
-  description: "Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.",
-  inputSchema: manageCertificateInputSchema,
-  annotations: {
-    readOnlyHint: false,
-    destructiveHint: true,
-    idempotentHint: false,
-    openWorldHint: false
-  },
-  snapshotPaths: ["certificate"],
-  async handler(params, context) {
-    const parsed = manageCertificateInputSchema.parse(params);
-    log26.info(
-      { routerId: context.routerId, action: parsed.action, name: parsed.name },
-      "Managing certificate"
-    );
-    try {
-      const allCerts = await context.routerClient.get("certificate");
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [
+                { property: "src-address", before: null, after: parsed.srcAddress },
+                { property: "dst-address", before: null, after: parsed.dstAddress },
+                { property: "action", before: null, after: parsed.ipsecAction }
+              ]
+            }
+          };
+        }
+        const body = {
+          "src-address": parsed.srcAddress,
+          "dst-address": parsed.dstAddress,
+          tunnel: tunnelStr,
+          action: parsed.ipsecAction,
+          level: parsed.level
+        };
+        if (parsed.saSourceAddress) body["sa-src-address"] = parsed.saSourceAddress;
+        if (parsed.saDstAddress) body["sa-dst-address"] = parsed.saDstAddress;
+        const created = await context.routerClient.create("ip/ipsec/policy", body);
+        log25.info({ id: created[".id"] }, "IPSec policy added");
+        return {
+          content: `Added IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress}.`,
+          structuredContent: { action: "created", policy: created }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress} not found. Nothing to remove.`,
+            structuredContent: {
+              action: "not_found",
+              srcAddress: parsed.srcAddress,
+              dstAddress: parsed.dstAddress
+            }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "src-address", before: parsed.srcAddress, after: null }]
+            }
+          };
+        }
+        await context.routerClient.remove("ip/ipsec/policy", existing[".id"]);
+        log25.info({ id: existing[".id"] }, "IPSec policy removed");
+        return {
+          content: `Removed IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress}.`,
+          structuredContent: { action: "removed", id: existing[".id"] }
+        };
+      }
+      if (!existing) {
+        throw new MikroMCPError({
+          category: "NOT_FOUND" /* NOT_FOUND */,
+          code: "IPSEC_POLICY_NOT_FOUND",
+          message: `IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress} not found.`,
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Verify with list_ipsec_policies.",
+            alternativeTools: ["list_ipsec_policies"]
+          }
+        });
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would ${parsed.action} IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress}.`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [
+              {
+                property: "disabled",
+                before: existing.disabled,
+                after: parsed.action === "disable" ? "true" : "false"
+              }
+            ]
+          }
+        };
+      }
+      await context.routerClient.update("ip/ipsec/policy", existing[".id"], {
+        disabled: parsed.action === "disable" ? "true" : "false"
+      });
+      const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
+      log25.info({ id: existing[".id"], action: resultAction }, "IPSec policy updated");
+      return {
+        content: `IPSec policy ${parsed.srcAddress} \u2192 ${parsed.dstAddress} ${resultAction}.`,
+        structuredContent: { action: resultAction, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ipsec_policy" });
+    }
+  }
+};
+var ipsecTools = [
+  listIpsecPeersTool,
+  listIpsecPoliciesTool,
+  manageIpsecPeerTool,
+  manageIpsecPolicyTool
+];
+
+// src/domain/tools/certificate-tools.ts
+import { z as z25 } from "zod";
+var log26 = createLogger("certificate-tools");
+var listCertificatesInputSchema = z25.object({
+  routerId: z25.string().describe("Target router identifier from the router registry"),
+  name: z25.string().optional().describe("Filter by certificate name (substring match)"),
+  expired: z25.boolean().optional().describe("Filter by expiry status; omit to return all"),
+  limit: z25.number().int().min(1).max(500).default(100).describe("Maximum number of certificates to return")
+}).strict();
+var listCertificatesTool = {
+  name: "list_certificates",
+  title: "List Certificates",
+  description: "List certificates on a MikroTik router.",
+  inputSchema: listCertificatesInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listCertificatesInputSchema.parse(params);
+    log26.info({ routerId: context.routerId }, "Listing certificates");
+    try {
+      const allCerts = await context.routerClient.get("certificate", {
+        limit: void 0,
+        offset: void 0
+      });
+      const now = /* @__PURE__ */ new Date();
+      const filtered = allCerts.filter((c) => parsed.name ? (c.name ?? "").includes(parsed.name) : true).filter((c) => {
+        if (parsed.expired === void 0) return true;
+        const invalidAfter = c["invalid-after"];
+        if (!invalidAfter) {
+          return parsed.expired === true;
+        }
+        const expiry = new Date(invalidAfter);
+        return parsed.expired ? expiry < now : expiry >= now;
+      });
+      const certs = filtered.slice(0, parsed.limit);
+      return {
+        content: `Certificates on ${context.routerId}: ${certs.length} returned (${allCerts.length} total)`,
+        structuredContent: {
+          routerId: context.routerId,
+          certificates: certs,
+          total: allCerts.length,
+          returned: certs.length
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_certificates" });
+    }
+  }
+};
+var manageCertificateInputSchema = z25.object({
+  routerId: z25.string().describe("Target router identifier from the router registry"),
+  action: z25.enum(["remove", "trust", "untrust"]).describe("Action to perform"),
+  name: z25.string().describe("Certificate name \u2014 idempotency key"),
+  dryRun: z25.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageCertificateTool = {
+  name: "manage_certificate",
+  title: "Manage Certificate",
+  description: "Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.",
+  inputSchema: manageCertificateInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  snapshotPaths: ["certificate"],
+  async handler(params, context) {
+    const parsed = manageCertificateInputSchema.parse(params);
+    log26.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing certificate"
+    );
+    try {
+      const allCerts = await context.routerClient.get("certificate");
       const cert = allCerts.find((c) => c.name === parsed.name);
       if (!cert) {
         throw new MikroMCPError({
@@ -6057,20 +6497,18 @@ var manageUserTool = {
 };
 var userTools = [listUsersTool, manageUserTool];
 
-// src/domain/tools/dhcp-server-tools.ts
+// src/domain/tools/user-group-tools.ts
 import { z as z27 } from "zod";
-var log28 = createLogger("dhcp-server-tools");
-var listDhcpServersInputSchema = z27.object({
+var log28 = createLogger("user-group-tools");
+var listUserGroupsInputSchema = z27.object({
   routerId: z27.string().describe("Target router identifier from the router registry"),
-  interface: z27.string().optional().describe("Filter by interface name (exact match)"),
-  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of DHCP servers to return"),
-  offset: z27.number().int().min(0).default(0).describe("Offset for pagination")
+  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of groups to return")
 }).strict();
-var listDhcpServersTool = {
-  name: "list_dhcp_servers",
-  title: "List DHCP Servers",
-  description: "List DHCP servers on a MikroTik router.",
-  inputSchema: listDhcpServersInputSchema,
+var listUserGroupsTool = {
+  name: "list_user_groups",
+  title: "List User Groups",
+  description: "List local user groups on a MikroTik router.",
+  inputSchema: listUserGroupsInputSchema,
   annotations: {
     readOnlyHint: true,
     destructiveHint: false,
@@ -6078,130 +6516,342 @@ var listDhcpServersTool = {
     openWorldHint: false
   },
   async handler(params, context) {
-    const parsed = listDhcpServersInputSchema.parse(params);
-    log28.info({ routerId: context.routerId }, "Listing DHCP servers");
+    const parsed = listUserGroupsInputSchema.parse(params);
+    log28.info({ routerId: context.routerId }, "Listing user groups");
     try {
-      const allServers = await context.routerClient.get("ip/dhcp-server", {
+      const all = await context.routerClient.get("user/group", {
         limit: void 0,
         offset: void 0
       });
-      let filtered = parsed.interface ? allServers.filter((s) => s.interface === parsed.interface) : allServers;
-      const total = filtered.length;
-      const servers = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
+      const groups = all.slice(0, parsed.limit);
       return {
-        content: `DHCP servers on ${context.routerId}: ${total} total, showing ${servers.length} (offset ${parsed.offset})`,
+        content: `User groups on ${context.routerId}: ${groups.length} returned (${all.length} total)`,
         structuredContent: {
           routerId: context.routerId,
-          servers,
-          total,
-          hasMore,
-          offset: parsed.offset,
-          limit: parsed.limit
+          groups,
+          total: all.length,
+          returned: groups.length
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_servers" });
+      throw enrichError(err, { routerId: context.routerId, tool: "list_user_groups" });
     }
   }
 };
-var manageDhcpServerInputSchema = z27.object({
+var manageUserGroupInputSchema = z27.object({
   routerId: z27.string().describe("Target router identifier from the router registry"),
-  action: z27.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z27.string().describe("Server name \u2014 idempotency key"),
-  interface: z27.string().optional().describe("Interface to serve DHCP on (required for add)"),
-  addressPool: z27.string().optional().describe("IP pool name (required for add)"),
-  leaseTime: z27.string().optional().describe("Lease duration (e.g. '1d', '12h')"),
-  comment: z27.string().optional().describe("Optional comment"),
+  action: z27.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z27.string().describe("Group name \u2014 idempotency key"),
+  policy: z27.string().optional().describe("Comma-separated policy list (e.g. 'read,write,ftp')"),
+  skin: z27.string().optional().describe("Optional skin name for the group"),
   dryRun: z27.boolean().default(false).describe("Preview changes without applying")
 }).strict();
-var manageDhcpServerTool = {
-  name: "manage_dhcp_server",
-  title: "Manage DHCP Server",
-  description: "Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.",
-  inputSchema: manageDhcpServerInputSchema,
+var manageUserGroupTool = {
+  name: "manage_user_group",
+  title: "Manage User Group",
+  description: "Add, update, or remove a local RouterOS user group. Idempotent by name: add returns already_exists if a group with the same name and policy already exists.",
+  inputSchema: manageUserGroupInputSchema,
   annotations: {
     readOnlyHint: false,
     destructiveHint: false,
     idempotentHint: true,
     openWorldHint: false
   },
-  snapshotPaths: ["ip/dhcp-server"],
+  snapshotPaths: ["user/group"],
   async handler(params, context) {
-    const parsed = manageDhcpServerInputSchema.parse(params);
+    const parsed = manageUserGroupInputSchema.parse(params);
     log28.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
-      "Managing DHCP server"
+      "Managing user group"
     );
     try {
-      const allServers = await context.routerClient.get("ip/dhcp-server", {
-        limit: void 0,
-        offset: void 0
-      });
-      const existing = allServers.find(
-        (s) => s.name === parsed.name
-      );
       if (parsed.action === "add") {
-        if (!parsed.interface) {
+        const all2 = await context.routerClient.get("user/group", {
+          limit: void 0,
+          offset: void 0
+        });
+        const existing2 = all2.find((g) => g.name === parsed.name);
+        if (existing2) {
+          if (parsed.policy === void 0 || existing2.policy === parsed.policy) {
+            return {
+              content: `User group "${parsed.name}" already exists. No changes made.`,
+              structuredContent: { action: "already_exists", name: parsed.name, policy: existing2.policy }
+            };
+          }
           throw new MikroMCPError({
-            category: "VALIDATION" /* VALIDATION */,
-            code: "DHCP_SERVER_INTERFACE_REQUIRED",
-            message: "interface is required when adding a DHCP server.",
-            details: { name: parsed.name },
+            category: "CONFLICT" /* CONFLICT */,
+            code: "USER_GROUP_CONFLICT",
+            message: `Group "${parsed.name}" exists with a different policy.`,
+            details: { existingPolicy: existing2.policy, requestedPolicy: parsed.policy },
             recoverability: {
               retryable: false,
-              suggestedAction: "Provide the interface name to serve DHCP on."
+              suggestedAction: "Remove the existing group first or use a different name.",
+              alternativeTools: ["manage_user_group"]
             }
           });
         }
-        if (!parsed.addressPool) {
-          throw new MikroMCPError({
-            category: "VALIDATION" /* VALIDATION */,
-            code: "DHCP_SERVER_POOL_REQUIRED",
-            message: "addressPool is required when adding a DHCP server.",
-            details: { name: parsed.name },
-            recoverability: {
-              retryable: false,
-              suggestedAction: "Provide the address pool name."
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add group "${parsed.name}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [
+                { property: "name", before: null, after: parsed.name },
+                { property: "policy", before: null, after: parsed.policy ?? "" }
+              ]
             }
-          });
+          };
         }
-        if (existing) {
-          if (existing.interface === parsed.interface && existing["address-pool"] === parsed.addressPool) {
-            return {
-              content: `DHCP server "${parsed.name}" already exists with the same interface and pool. No changes made.`,
-              structuredContent: { action: "already_exists", server: existing }
-            };
+        const body = { name: parsed.name };
+        if (parsed.policy !== void 0) body.policy = parsed.policy;
+        if (parsed.skin !== void 0) body.skin = parsed.skin;
+        const created = await context.routerClient.create("user/group", body);
+        log28.info({ name: parsed.name, id: created[".id"] }, "User group added");
+        return {
+          content: `Added group "${parsed.name}".`,
+          structuredContent: {
+            action: "created",
+            routerId: context.routerId,
+            name: parsed.name,
+            id: created[".id"]
           }
+        };
+      }
+      if (parsed.action === "update") {
+        const all2 = await context.routerClient.get("user/group", {
+          limit: void 0,
+          offset: void 0
+        });
+        const existing2 = all2.find((g) => g.name === parsed.name);
+        if (!existing2) {
           throw new MikroMCPError({
-            category: "CONFLICT" /* CONFLICT */,
-            code: "DHCP_SERVER_CONFLICT",
-            message: `DHCP server "${parsed.name}" exists with different configuration.`,
-            details: {
-              existing: {
-                interface: existing.interface,
-                addressPool: existing["address-pool"]
-              },
-              requested: {
-                interface: parsed.interface,
-                addressPool: parsed.addressPool
-              }
-            },
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "USER_GROUP_NOT_FOUND",
+            message: `Group "${parsed.name}" not found.`,
+            details: { name: parsed.name },
             recoverability: {
               retryable: false,
-              suggestedAction: "Remove the existing server first or use a different name.",
-              alternativeTools: ["manage_dhcp_server"]
+              suggestedAction: "Verify the group name with list_user_groups.",
+              alternativeTools: ["list_user_groups"]
             }
           });
         }
-        if (parsed.dryRun) {
-          const diff = [
-            { property: "name", before: null, after: parsed.name },
-            { property: "interface", before: null, after: parsed.interface },
-            { property: "address-pool", before: null, after: parsed.addressPool },
-            ...parsed.leaseTime ? [{ property: "lease-time", before: null, after: parsed.leaseTime }] : [],
-            ...parsed.comment ? [{ property: "comment", before: null, after: parsed.comment }] : []
-          ];
+        if (parsed.policy !== void 0 && existing2.policy === parsed.policy) {
+          return {
+            content: `Group "${parsed.name}" already has the requested policy. No changes made.`,
+            structuredContent: { action: "no_change", name: parsed.name }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would update group "${parsed.name}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [
+                {
+                  property: "policy",
+                  before: existing2.policy ?? null,
+                  after: parsed.policy ?? null
+                }
+              ]
+            }
+          };
+        }
+        const changes = {};
+        if (parsed.policy !== void 0) changes.policy = parsed.policy;
+        if (parsed.skin !== void 0) changes.skin = parsed.skin;
+        if (Object.keys(changes).length === 0) {
+          return {
+            content: `User group "${parsed.name}" already has the requested configuration. No changes made.`,
+            structuredContent: { action: "no_change", name: parsed.name }
+          };
+        }
+        await context.routerClient.update("user/group", existing2[".id"], changes);
+        log28.info({ name: parsed.name }, "User group updated");
+        return {
+          content: `Updated group "${parsed.name}".`,
+          structuredContent: { action: "updated", routerId: context.routerId, name: parsed.name }
+        };
+      }
+      const all = await context.routerClient.get("user/group", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find((g) => g.name === parsed.name);
+      if (!existing) {
+        return {
+          content: `Group "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove group "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove("user/group", existing[".id"]);
+      log28.info({ name: parsed.name }, "User group removed");
+      return {
+        content: `Removed group "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_user_group" });
+    }
+  }
+};
+var userGroupTools = [listUserGroupsTool, manageUserGroupTool];
+
+// src/domain/tools/dhcp-server-tools.ts
+import { z as z28 } from "zod";
+var log29 = createLogger("dhcp-server-tools");
+var listDhcpServersInputSchema = z28.object({
+  routerId: z28.string().describe("Target router identifier from the router registry"),
+  interface: z28.string().optional().describe("Filter by interface name (exact match)"),
+  limit: z28.number().int().min(1).max(500).default(100).describe("Maximum number of DHCP servers to return"),
+  offset: z28.number().int().min(0).default(0).describe("Offset for pagination")
+}).strict();
+var listDhcpServersTool = {
+  name: "list_dhcp_servers",
+  title: "List DHCP Servers",
+  description: "List DHCP servers on a MikroTik router.",
+  inputSchema: listDhcpServersInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listDhcpServersInputSchema.parse(params);
+    log29.info({ routerId: context.routerId }, "Listing DHCP servers");
+    try {
+      const allServers = await context.routerClient.get("ip/dhcp-server", {
+        limit: void 0,
+        offset: void 0
+      });
+      let filtered = parsed.interface ? allServers.filter((s) => s.interface === parsed.interface) : allServers;
+      const total = filtered.length;
+      const servers = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
+      return {
+        content: `DHCP servers on ${context.routerId}: ${total} total, showing ${servers.length} (offset ${parsed.offset})`,
+        structuredContent: {
+          routerId: context.routerId,
+          servers,
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_servers" });
+    }
+  }
+};
+var manageDhcpServerInputSchema = z28.object({
+  routerId: z28.string().describe("Target router identifier from the router registry"),
+  action: z28.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z28.string().describe("Server name \u2014 idempotency key"),
+  interface: z28.string().optional().describe("Interface to serve DHCP on (required for add)"),
+  addressPool: z28.string().optional().describe("IP pool name (required for add)"),
+  leaseTime: z28.string().optional().describe("Lease duration (e.g. '1d', '12h')"),
+  comment: z28.string().optional().describe("Optional comment"),
+  dryRun: z28.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageDhcpServerTool = {
+  name: "manage_dhcp_server",
+  title: "Manage DHCP Server",
+  description: "Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.",
+  inputSchema: manageDhcpServerInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["ip/dhcp-server"],
+  async handler(params, context) {
+    const parsed = manageDhcpServerInputSchema.parse(params);
+    log29.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing DHCP server"
+    );
+    try {
+      const allServers = await context.routerClient.get("ip/dhcp-server", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allServers.find(
+        (s) => s.name === parsed.name
+      );
+      if (parsed.action === "add") {
+        if (!parsed.interface) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "DHCP_SERVER_INTERFACE_REQUIRED",
+            message: "interface is required when adding a DHCP server.",
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the interface name to serve DHCP on."
+            }
+          });
+        }
+        if (!parsed.addressPool) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "DHCP_SERVER_POOL_REQUIRED",
+            message: "addressPool is required when adding a DHCP server.",
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the address pool name."
+            }
+          });
+        }
+        if (existing) {
+          if (existing.interface === parsed.interface && existing["address-pool"] === parsed.addressPool) {
+            return {
+              content: `DHCP server "${parsed.name}" already exists with the same interface and pool. No changes made.`,
+              structuredContent: { action: "already_exists", server: existing }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "DHCP_SERVER_CONFLICT",
+            message: `DHCP server "${parsed.name}" exists with different configuration.`,
+            details: {
+              existing: {
+                interface: existing.interface,
+                addressPool: existing["address-pool"]
+              },
+              requested: {
+                interface: parsed.interface,
+                addressPool: parsed.addressPool
+              }
+            },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Remove the existing server first or use a different name.",
+              alternativeTools: ["manage_dhcp_server"]
+            }
+          });
+        }
+        if (parsed.dryRun) {
+          const diff = [
+            { property: "name", before: null, after: parsed.name },
+            { property: "interface", before: null, after: parsed.interface },
+            { property: "address-pool", before: null, after: parsed.addressPool },
+            ...parsed.leaseTime ? [{ property: "lease-time", before: null, after: parsed.leaseTime }] : [],
+            ...parsed.comment ? [{ property: "comment", before: null, after: parsed.comment }] : []
+          ];
           return {
             content: `Dry run: Would add DHCP server "${parsed.name}".`,
             structuredContent: { action: "dry_run", diff }
@@ -6215,7 +6865,7 @@ var manageDhcpServerTool = {
         if (parsed.leaseTime) body["lease-time"] = parsed.leaseTime;
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("ip/dhcp-server", body);
-        log28.info({ name: parsed.name, id: created[".id"] }, "DHCP server added");
+        log29.info({ name: parsed.name, id: created[".id"] }, "DHCP server added");
         return {
           content: `Added DHCP server "${parsed.name}".`,
           structuredContent: { action: "created", server: created }
@@ -6238,7 +6888,7 @@ var manageDhcpServerTool = {
           };
         }
         await context.routerClient.remove("ip/dhcp-server", existing[".id"]);
-        log28.info({ name: parsed.name }, "DHCP server removed");
+        log29.info({ name: parsed.name }, "DHCP server removed");
         return {
           content: `Removed DHCP server "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6277,7 +6927,7 @@ var manageDhcpServerTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log28.info({ name: parsed.name, action: resultAction }, "DHCP server updated");
+      log29.info({ name: parsed.name, action: resultAction }, "DHCP server updated");
       return {
         content: `DHCP server "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -6291,13 +6941,13 @@ var manageDhcpServerTool = {
 var dhcpServerTools = [listDhcpServersTool, manageDhcpServerTool];
 
 // src/domain/tools/ip-pool-tools.ts
-import { z as z28 } from "zod";
-var log29 = createLogger("ip-pool-tools");
-var listIpPoolsInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  name: z28.string().optional().describe("Filter by pool name (substring match)"),
-  limit: z28.number().int().min(1).max(500).default(100).describe("Maximum number of pools to return"),
-  offset: z28.number().int().min(0).default(0).describe("Offset for pagination")
+import { z as z29 } from "zod";
+var log30 = createLogger("ip-pool-tools");
+var listIpPoolsInputSchema = z29.object({
+  routerId: z29.string().describe("Target router identifier from the router registry"),
+  name: z29.string().optional().describe("Filter by pool name (substring match)"),
+  limit: z29.number().int().min(1).max(500).default(100).describe("Maximum number of pools to return"),
+  offset: z29.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 var listIpPoolsTool = {
   name: "list_ip_pools",
@@ -6312,7 +6962,7 @@ var listIpPoolsTool = {
   },
   async handler(params, context) {
     const parsed = listIpPoolsInputSchema.parse(params);
-    log29.info({ routerId: context.routerId }, "Listing IP pools");
+    log30.info({ routerId: context.routerId }, "Listing IP pools");
     try {
       const allPools = await context.routerClient.get("ip/pool", {
         limit: void 0,
@@ -6341,13 +6991,13 @@ var listIpPoolsTool = {
     }
   }
 };
-var manageIpPoolInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  action: z28.enum(["add", "remove"]).describe("Action to perform"),
-  name: z28.string().describe("Pool name \u2014 idempotency key"),
-  ranges: z28.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
-  nextPool: z28.string().optional().describe("Next pool name for overflow"),
-  dryRun: z28.boolean().default(false).describe("Preview changes without applying")
+var manageIpPoolInputSchema = z29.object({
+  routerId: z29.string().describe("Target router identifier from the router registry"),
+  action: z29.enum(["add", "remove"]).describe("Action to perform"),
+  name: z29.string().describe("Pool name \u2014 idempotency key"),
+  ranges: z29.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
+  nextPool: z29.string().optional().describe("Next pool name for overflow"),
+  dryRun: z29.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageIpPoolTool = {
   name: "manage_ip_pool",
@@ -6363,7 +7013,7 @@ var manageIpPoolTool = {
   snapshotPaths: ["ip/pool"],
   async handler(params, context) {
     const parsed = manageIpPoolInputSchema.parse(params);
-    log29.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP pool");
+    log30.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP pool");
     try {
       const allPools = await context.routerClient.get("ip/pool", {
         limit: void 0,
@@ -6416,7 +7066,7 @@ var manageIpPoolTool = {
         const body = { name: parsed.name, ranges: parsed.ranges };
         if (parsed.nextPool) body["next-pool"] = parsed.nextPool;
         const created = await context.routerClient.create("ip/pool", body);
-        log29.info({ name: parsed.name, id: created[".id"] }, "IP pool added");
+        log30.info({ name: parsed.name, id: created[".id"] }, "IP pool added");
         return {
           content: `Added IP pool "${parsed.name}" with ranges ${parsed.ranges}.`,
           structuredContent: { action: "created", pool: created }
@@ -6435,7 +7085,7 @@ var manageIpPoolTool = {
         };
       }
       await context.routerClient.remove("ip/pool", existing[".id"]);
-      log29.info({ name: parsed.name }, "IP pool removed");
+      log30.info({ name: parsed.name }, "IP pool removed");
       return {
         content: `Removed IP pool "${parsed.name}".`,
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6449,12 +7099,12 @@ var manageIpPoolTool = {
 var ipPoolTools = [listIpPoolsTool, manageIpPoolTool];
 
 // src/domain/tools/queue-tools.ts
-import { z as z29 } from "zod";
-var log30 = createLogger("queue-tools");
-var listQueuesInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  target: z29.string().optional().describe("Filter by target address (substring match)"),
-  limit: z29.number().int().min(1).max(500).default(100).describe("Maximum number of queues to return")
+import { z as z30 } from "zod";
+var log31 = createLogger("queue-tools");
+var listQueuesInputSchema = z30.object({
+  routerId: z30.string().describe("Target router identifier from the router registry"),
+  target: z30.string().optional().describe("Filter by target address (substring match)"),
+  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of queues to return")
 }).strict();
 var listQueuesTool = {
   name: "list_queues",
@@ -6469,7 +7119,7 @@ var listQueuesTool = {
   },
   async handler(params, context) {
     const parsed = listQueuesInputSchema.parse(params);
-    log30.info({ routerId: context.routerId }, "Listing queues");
+    log31.info({ routerId: context.routerId }, "Listing queues");
     try {
       const allQueues = await context.routerClient.get("queue/simple", {
         limit: void 0,
@@ -6493,15 +7143,15 @@ var listQueuesTool = {
     }
   }
 };
-var manageQueueInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  action: z29.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z29.string().describe("Queue name \u2014 idempotency key"),
-  target: z29.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
-  maxLimit: z29.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
-  limitAt: z29.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
-  comment: z29.string().optional().describe("Optional comment"),
-  dryRun: z29.boolean().default(false).describe("Preview changes without applying")
+var manageQueueInputSchema = z30.object({
+  routerId: z30.string().describe("Target router identifier from the router registry"),
+  action: z30.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z30.string().describe("Queue name \u2014 idempotency key"),
+  target: z30.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
+  maxLimit: z30.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
+  limitAt: z30.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
+  comment: z30.string().optional().describe("Optional comment"),
+  dryRun: z30.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageQueueTool = {
   name: "manage_queue",
@@ -6517,7 +7167,7 @@ var manageQueueTool = {
   snapshotPaths: ["queue/simple"],
   async handler(params, context) {
     const parsed = manageQueueInputSchema.parse(params);
-    log30.info(
+    log31.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
       "Managing queue"
     );
@@ -6579,7 +7229,7 @@ var manageQueueTool = {
         if (parsed.limitAt) body["limit-at"] = parsed.limitAt;
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("queue/simple", body);
-        log30.info({ name: parsed.name, id: created[".id"] }, "Queue added");
+        log31.info({ name: parsed.name, id: created[".id"] }, "Queue added");
         return {
           content: `Added queue "${parsed.name}".`,
           structuredContent: { action: "created", queue: created }
@@ -6602,7 +7252,7 @@ var manageQueueTool = {
           };
         }
         await context.routerClient.remove("queue/simple", existing[".id"]);
-        log30.info({ name: parsed.name }, "Queue removed");
+        log31.info({ name: parsed.name }, "Queue removed");
         return {
           content: `Removed queue "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6641,7 +7291,7 @@ var manageQueueTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log30.info({ name: parsed.name, action: resultAction }, "Queue updated");
+      log31.info({ name: parsed.name, action: resultAction }, "Queue updated");
       return {
         content: `Queue "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -6655,12 +7305,12 @@ var manageQueueTool = {
 var queueTools = [listQueuesTool, manageQueueTool];
 
 // src/domain/tools/vrrp-tools.ts
-import { z as z30 } from "zod";
-var log31 = createLogger("vrrp-tools");
-var listVrrpInstancesInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  interface: z30.string().optional().describe("Filter by master interface name (exact match)"),
-  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of instances to return")
+import { z as z31 } from "zod";
+var log32 = createLogger("vrrp-tools");
+var listVrrpInstancesInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  interface: z31.string().optional().describe("Filter by master interface name (exact match)"),
+  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of instances to return")
 }).strict();
 var listVrrpInstancesTool = {
   name: "list_vrrp_instances",
@@ -6675,7 +7325,7 @@ var listVrrpInstancesTool = {
   },
   async handler(params, context) {
     const parsed = listVrrpInstancesInputSchema.parse(params);
-    log31.info({ routerId: context.routerId }, "Listing VRRP instances");
+    log32.info({ routerId: context.routerId }, "Listing VRRP instances");
     try {
       const allInstances = await context.routerClient.get("interface/vrrp", {
         limit: void 0,
@@ -6699,17 +7349,17 @@ var listVrrpInstancesTool = {
     }
   }
 };
-var manageVrrpInstanceInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  action: z30.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z30.string().describe("VRRP interface name \u2014 idempotency key"),
-  interface: z30.string().optional().describe("Master interface (required for add)"),
-  vrid: z30.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
-  priority: z30.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
-  interval: z30.number().int().min(1).optional().describe("Advertisement interval in seconds"),
-  version: z30.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
-  comment: z30.string().optional().describe("Optional comment"),
-  dryRun: z30.boolean().default(false).describe("Preview changes without applying")
+var manageVrrpInstanceInputSchema = z31.object({
+  routerId: z31.string().describe("Target router identifier from the router registry"),
+  action: z31.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z31.string().describe("VRRP interface name \u2014 idempotency key"),
+  interface: z31.string().optional().describe("Master interface (required for add)"),
+  vrid: z31.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
+  priority: z31.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
+  interval: z31.number().int().min(1).optional().describe("Advertisement interval in seconds"),
+  version: z31.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
+  comment: z31.string().optional().describe("Optional comment"),
+  dryRun: z31.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageVrrpInstanceTool = {
   name: "manage_vrrp_instance",
@@ -6725,7 +7375,7 @@ var manageVrrpInstanceTool = {
   snapshotPaths: ["interface/vrrp"],
   async handler(params, context) {
     const parsed = manageVrrpInstanceInputSchema.parse(params);
-    log31.info(
+    log32.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
       "Managing VRRP instance"
     );
@@ -6809,7 +7459,7 @@ var manageVrrpInstanceTool = {
         if (parsed.interval) body.interval = String(parsed.interval);
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("interface/vrrp", body);
-        log31.info({ name: parsed.name, id: created[".id"] }, "VRRP instance added");
+        log32.info({ name: parsed.name, id: created[".id"] }, "VRRP instance added");
         return {
           content: `Added VRRP instance "${parsed.name}".`,
           structuredContent: { action: "created", instance: created }
@@ -6832,7 +7482,7 @@ var manageVrrpInstanceTool = {
           };
         }
         await context.routerClient.remove("interface/vrrp", existing[".id"]);
-        log31.info({ name: parsed.name }, "VRRP instance removed");
+        log32.info({ name: parsed.name }, "VRRP instance removed");
         return {
           content: `Removed VRRP instance "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -6871,7 +7521,7 @@ var manageVrrpInstanceTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log31.info({ name: parsed.name, action: resultAction }, "VRRP instance updated");
+      log32.info({ name: parsed.name, action: resultAction }, "VRRP instance updated");
       return {
         content: `VRRP instance "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -6885,10 +7535,10 @@ var manageVrrpInstanceTool = {
 var vrrpTools = [listVrrpInstancesTool, manageVrrpInstanceTool];
 
 // src/domain/tools/network-services-tools.ts
-import { z as z31 } from "zod";
-var log32 = createLogger("network-services-tools");
-var getSnmpSettingsInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry")
+import { z as z32 } from "zod";
+var log33 = createLogger("network-services-tools");
+var getSnmpSettingsInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry")
 }).strict();
 var getSnmpSettingsTool = {
   name: "get_snmp_settings",
@@ -6903,7 +7553,7 @@ var getSnmpSettingsTool = {
   },
   async handler(params, context) {
     const parsed = getSnmpSettingsInputSchema.parse(params);
-    log32.info({ routerId: context.routerId }, "Fetching SNMP settings");
+    log33.info({ routerId: context.routerId }, "Fetching SNMP settings");
     try {
       const results2 = await context.routerClient.get("snmp");
       if (!results2 || results2.length === 0) {
@@ -6932,8 +7582,8 @@ var getSnmpSettingsTool = {
     }
   }
 };
-var getNtpSettingsInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry")
+var getNtpSettingsInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry")
 }).strict();
 var getNtpSettingsTool = {
   name: "get_ntp_settings",
@@ -6948,7 +7598,7 @@ var getNtpSettingsTool = {
   },
   async handler(params, context) {
     const parsed = getNtpSettingsInputSchema.parse(params);
-    log32.info({ routerId: context.routerId }, "Fetching NTP settings");
+    log33.info({ routerId: context.routerId }, "Fetching NTP settings");
     try {
       const results2 = await context.routerClient.get("system/ntp/client");
       if (!results2 || results2.length === 0) {
@@ -6977,11 +7627,11 @@ var getNtpSettingsTool = {
     }
   }
 };
-var listNetwatchEntriesInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  host: z31.string().optional().describe("Filter by host (substring match)"),
-  status: z31.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
-  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return")
+var listNetwatchEntriesInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry"),
+  host: z32.string().optional().describe("Filter by host (substring match)"),
+  status: z32.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
+  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return")
 }).strict();
 var listNetwatchEntriesTool = {
   name: "list_netwatch_entries",
@@ -6996,7 +7646,7 @@ var listNetwatchEntriesTool = {
   },
   async handler(params, context) {
     const parsed = listNetwatchEntriesInputSchema.parse(params);
-    log32.info({ routerId: context.routerId }, "Listing Netwatch entries");
+    log33.info({ routerId: context.routerId }, "Listing Netwatch entries");
     try {
       const allEntries = await context.routerClient.get("tool/netwatch", {
         limit: void 0,
@@ -7018,15 +7668,15 @@ var listNetwatchEntriesTool = {
     }
   }
 };
-var manageNetwatchEntryInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  action: z31.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  host: z31.string().describe("Host to monitor \u2014 idempotency key"),
-  port: z31.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
-  interval: z31.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
-  timeout: z31.string().optional().describe("Probe timeout (e.g. '500ms')"),
-  comment: z31.string().optional().describe("Optional comment"),
-  dryRun: z31.boolean().default(false).describe("Preview changes without applying")
+var manageNetwatchEntryInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry"),
+  action: z32.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  host: z32.string().describe("Host to monitor \u2014 idempotency key"),
+  port: z32.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
+  interval: z32.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
+  timeout: z32.string().optional().describe("Probe timeout (e.g. '500ms')"),
+  comment: z32.string().optional().describe("Optional comment"),
+  dryRun: z32.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageNetwatchEntryTool = {
   name: "manage_netwatch_entry",
@@ -7042,7 +7692,7 @@ var manageNetwatchEntryTool = {
   snapshotPaths: ["tool/netwatch"],
   async handler(params, context) {
     const parsed = manageNetwatchEntryInputSchema.parse(params);
-    log32.info(
+    log33.info(
       { routerId: context.routerId, action: parsed.action, host: parsed.host },
       "Managing Netwatch entry"
     );
@@ -7099,7 +7749,7 @@ var manageNetwatchEntryTool = {
         if (parsed.timeout) body.timeout = parsed.timeout;
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("tool/netwatch", body);
-        log32.info({ host: parsed.host, id: created[".id"] }, "Netwatch entry added");
+        log33.info({ host: parsed.host, id: created[".id"] }, "Netwatch entry added");
         return {
           content: `Added Netwatch entry for "${parsed.host}".`,
           structuredContent: { action: "created", entry: created }
@@ -7123,7 +7773,7 @@ var manageNetwatchEntryTool = {
           };
         }
         await context.routerClient.remove("tool/netwatch", existing2[".id"]);
-        log32.info({ host: parsed.host }, "Netwatch entry removed");
+        log33.info({ host: parsed.host }, "Netwatch entry removed");
         return {
           content: `Removed Netwatch entry for "${parsed.host}".`,
           structuredContent: { action: "removed", host: parsed.host, id: existing2[".id"] }
@@ -7163,7 +7813,7 @@ var manageNetwatchEntryTool = {
         disabled: disabledValue
       });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log32.info({ host: parsed.host, action: resultAction }, "Netwatch entry updated");
+      log33.info({ host: parsed.host, action: resultAction }, "Netwatch entry updated");
       return {
         content: `Netwatch entry for "${parsed.host}" ${resultAction}.`,
         structuredContent: { action: resultAction, host: parsed.host, id: existing[".id"] }
@@ -7174,10 +7824,10 @@ var manageNetwatchEntryTool = {
     }
   }
 };
-var listNeighborsInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  interface: z31.string().optional().describe("Filter by interface name (substring match)"),
-  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of neighbors to return")
+var listNeighborsInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry"),
+  interface: z32.string().optional().describe("Filter by interface name (substring match)"),
+  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of neighbors to return")
 }).strict();
 var listNeighborsTool = {
   name: "list_neighbors",
@@ -7192,7 +7842,7 @@ var listNeighborsTool = {
   },
   async handler(params, context) {
     const parsed = listNeighborsInputSchema.parse(params);
-    log32.info({ routerId: context.routerId }, "Listing neighbors");
+    log33.info({ routerId: context.routerId }, "Listing neighbors");
     try {
       const allNeighbors = await context.routerClient.get("ip/neighbor", {
         limit: void 0,
@@ -7216,12 +7866,12 @@ var listNeighborsTool = {
     }
   }
 };
-var listArpEntriesInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  interface: z31.string().optional().describe("Filter by interface (substring match)"),
-  address: z31.string().optional().describe("Filter by IP address (substring match)"),
-  macAddress: z31.string().optional().describe("Filter by MAC address (substring match)"),
-  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of ARP entries to return")
+var listArpEntriesInputSchema = z32.object({
+  routerId: z32.string().describe("Target router identifier from the router registry"),
+  interface: z32.string().optional().describe("Filter by interface (substring match)"),
+  address: z32.string().optional().describe("Filter by IP address (substring match)"),
+  macAddress: z32.string().optional().describe("Filter by MAC address (substring match)"),
+  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of ARP entries to return")
 }).strict();
 var listArpEntriesTool = {
   name: "list_arp_entries",
@@ -7236,7 +7886,7 @@ var listArpEntriesTool = {
   },
   async handler(params, context) {
     const parsed = listArpEntriesInputSchema.parse(params);
-    log32.info({ routerId: context.routerId }, "Listing ARP entries");
+    log33.info({ routerId: context.routerId }, "Listing ARP entries");
     try {
       const allEntries = await context.routerClient.get("ip/arp", {
         limit: void 0,
@@ -7260,54 +7910,127 @@ var listArpEntriesTool = {
     }
   }
 };
-var networkServicesTools = [
-  getSnmpSettingsTool,
-  getNtpSettingsTool,
-  listNetwatchEntriesTool,
-  manageNetwatchEntryTool,
-  listNeighborsTool,
-  listArpEntriesTool
-];
-
-// src/domain/tools/vlan-tools.ts
-import { z as z32 } from "zod";
-var log33 = createLogger("vlan-tools");
-function sanitizeComment4(comment) {
-  if (comment === void 0) return void 0;
-  return comment.replace(/[\x00-\x1f\x7f]/g, "");
-}
-var manageVlanInputSchema = z32.object({
+var manageNtpClientInputSchema = z32.object({
   routerId: z32.string().describe("Target router identifier from the router registry"),
-  action: z32.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z32.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
-  vlanId: z32.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
-  parentInterface: z32.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
-  mtu: z32.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
-  disabled: z32.boolean().default(false).describe("Whether to create the VLAN disabled (add only)"),
-  comment: z32.string().max(255).optional().describe("Optional comment (add only)"),
+  enabled: z32.boolean().optional().describe("Enable or disable the NTP client"),
+  mode: z32.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client mode"),
+  servers: z32.string().optional().describe("Comma-separated NTP server addresses"),
+  vlanInterface: z32.string().optional().describe("VLAN interface for NTP communication"),
   dryRun: z32.boolean().default(false).describe("Preview changes without applying")
 }).strict();
-var manageVlanTool = {
-  name: "manage_vlan",
-  title: "Manage VLAN Interface",
-  description: "Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.",
-  inputSchema: manageVlanInputSchema,
+var manageNtpClientTool = {
+  name: "manage_ntp_client",
+  title: "Manage NTP Client",
+  description: "Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.",
+  inputSchema: manageNtpClientInputSchema,
   annotations: {
     readOnlyHint: false,
-    destructiveHint: true,
+    destructiveHint: false,
     idempotentHint: true,
     openWorldHint: false
   },
-  snapshotPaths: ["interface/vlan"],
+  snapshotPaths: ["system/ntp/client"],
   async handler(params, context) {
-    const parsed = manageVlanInputSchema.parse(params);
-    const comment = sanitizeComment4(parsed.comment);
-    log33.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing VLAN");
+    const parsed = manageNtpClientInputSchema.parse(params);
+    log33.info({ routerId: context.routerId }, "Managing NTP client settings");
     try {
-      const allVlans = await context.routerClient.get("interface/vlan", {
-        limit: void 0,
-        offset: void 0
-      });
+      const results2 = await context.routerClient.get("system/ntp/client");
+      const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
+      const id = current[".id"];
+      const changes = {};
+      const diff = [];
+      if (parsed.enabled !== void 0 && current.enabled !== String(parsed.enabled)) {
+        changes.enabled = String(parsed.enabled);
+        diff.push({ property: "enabled", before: current.enabled, after: String(parsed.enabled) });
+      }
+      if (parsed.mode !== void 0 && current.mode !== parsed.mode) {
+        changes.mode = parsed.mode;
+        diff.push({ property: "mode", before: current.mode, after: parsed.mode });
+      }
+      if (parsed.servers !== void 0 && current.servers !== parsed.servers) {
+        changes.servers = parsed.servers;
+        diff.push({ property: "servers", before: current.servers, after: parsed.servers });
+      }
+      if (parsed.vlanInterface !== void 0 && current["vlan-interface"] !== parsed.vlanInterface) {
+        changes["vlan-interface"] = parsed.vlanInterface;
+        diff.push({
+          property: "vlan-interface",
+          before: current["vlan-interface"],
+          after: parsed.vlanInterface
+        });
+      }
+      if (diff.length === 0) {
+        return {
+          content: `NTP client on ${context.routerId} already matches requested configuration.`,
+          structuredContent: { action: "already_set", routerId: context.routerId }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would update NTP client on ${context.routerId}.`,
+          structuredContent: { action: "dry_run", diff }
+        };
+      }
+      await context.routerClient.update("system/ntp/client", id, changes);
+      log33.info({ routerId: context.routerId }, "NTP client updated");
+      return {
+        content: `NTP client on ${context.routerId} updated.`,
+        structuredContent: { action: "updated", routerId: context.routerId, diff }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ntp_client" });
+    }
+  }
+};
+var networkServicesTools = [
+  getSnmpSettingsTool,
+  getNtpSettingsTool,
+  listNetwatchEntriesTool,
+  manageNetwatchEntryTool,
+  listNeighborsTool,
+  listArpEntriesTool,
+  manageNtpClientTool
+];
+
+// src/domain/tools/vlan-tools.ts
+import { z as z33 } from "zod";
+var log34 = createLogger("vlan-tools");
+function sanitizeComment4(comment) {
+  if (comment === void 0) return void 0;
+  return comment.replace(/[\x00-\x1f\x7f]/g, "");
+}
+var manageVlanInputSchema = z33.object({
+  routerId: z33.string().describe("Target router identifier from the router registry"),
+  action: z33.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z33.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
+  vlanId: z33.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
+  parentInterface: z33.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
+  mtu: z33.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
+  disabled: z33.boolean().default(false).describe("Whether to create the VLAN disabled (add only)"),
+  comment: z33.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun: z33.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageVlanTool = {
+  name: "manage_vlan",
+  title: "Manage VLAN Interface",
+  description: "Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.",
+  inputSchema: manageVlanInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["interface/vlan"],
+  async handler(params, context) {
+    const parsed = manageVlanInputSchema.parse(params);
+    const comment = sanitizeComment4(parsed.comment);
+    log34.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing VLAN");
+    try {
+      const allVlans = await context.routerClient.get("interface/vlan", {
+        limit: void 0,
+        offset: void 0
+      });
       const existing = allVlans.find((v) => v.name === parsed.name);
       if (parsed.action === "add") {
         if (parsed.vlanId === void 0) {
@@ -7330,7 +8053,7 @@ var manageVlanTool = {
         }
         if (existing) {
           if (existing["vlan-id"] === String(parsed.vlanId) && existing.interface === parsed.parentInterface) {
-            log33.info({ name: parsed.name }, "VLAN already exists with matching config");
+            log34.info({ name: parsed.name }, "VLAN already exists with matching config");
             return {
               content: `VLAN "${parsed.name}" already exists with VLAN ID ${parsed.vlanId} on ${parsed.parentInterface}. No changes made.`,
               structuredContent: { action: "already_exists", vlan: existing }
@@ -7374,7 +8097,7 @@ var manageVlanTool = {
         };
         if (comment) body.comment = comment;
         const created = await context.routerClient.create("interface/vlan", body);
-        log33.info({ name: parsed.name, id: created[".id"] }, "VLAN created");
+        log34.info({ name: parsed.name, id: created[".id"] }, "VLAN created");
         return {
           content: `Created VLAN "${parsed.name}" (ID ${parsed.vlanId}) on ${parsed.parentInterface} with MTU ${parsed.mtu}.`,
           structuredContent: { action: "created", vlan: created }
@@ -7394,7 +8117,7 @@ var manageVlanTool = {
           };
         }
         await context.routerClient.remove("interface/vlan", existing[".id"]);
-        log33.info({ name: parsed.name }, "VLAN removed");
+        log34.info({ name: parsed.name }, "VLAN removed");
         return {
           content: `Removed VLAN "${parsed.name}".`,
           structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -7425,7 +8148,7 @@ var manageVlanTool = {
       const disabledValue = parsed.action === "disable" ? "true" : "false";
       await context.routerClient.update("interface/vlan", existing[".id"], { disabled: disabledValue });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log33.info({ name: parsed.name, action: resultAction }, "VLAN updated");
+      log34.info({ name: parsed.name, action: resultAction }, "VLAN updated");
       return {
         content: `VLAN "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -7439,14 +8162,14 @@ var manageVlanTool = {
 var vlanTools = [manageVlanTool];
 
 // src/domain/tools/dhcp-client-tools.ts
-import { z as z33 } from "zod";
-var log34 = createLogger("dhcp-client-tools");
-var listDhcpClientsInputSchema = z33.object({
-  routerId: z33.string().describe("Target router identifier from the router registry"),
-  interface: z33.string().optional().describe("Filter by interface name (exact match)"),
-  status: z33.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
-  limit: z33.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z33.number().int().min(0).default(0).describe("Offset for pagination")
+import { z as z34 } from "zod";
+var log35 = createLogger("dhcp-client-tools");
+var listDhcpClientsInputSchema = z34.object({
+  routerId: z34.string().describe("Target router identifier from the router registry"),
+  interface: z34.string().optional().describe("Filter by interface name (exact match)"),
+  status: z34.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
+  limit: z34.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z34.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 var listDhcpClientsTool = {
   name: "list_dhcp_clients",
@@ -7461,7 +8184,7 @@ var listDhcpClientsTool = {
   },
   async handler(params, context) {
     const parsed = listDhcpClientsInputSchema.parse(params);
-    log34.info({ routerId: context.routerId }, "Listing DHCP clients");
+    log35.info({ routerId: context.routerId }, "Listing DHCP clients");
     try {
       const allClients = await context.routerClient.get("ip/dhcp-client", {
         limit: void 0,
@@ -7504,15 +8227,15 @@ var listDhcpClientsTool = {
     }
   }
 };
-var manageDhcpClientInputSchema = z33.object({
-  routerId: z33.string().describe("Target router identifier from the router registry"),
-  action: z33.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  interface: z33.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
-  usePeerDns: z33.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
-  usePeerNtp: z33.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
-  addDefaultRoute: z33.boolean().default(true).describe("Add default route from DHCP (add only)"),
-  comment: z33.string().max(255).optional().describe("Optional comment (add only)"),
-  dryRun: z33.boolean().default(false).describe("Preview changes without applying")
+var manageDhcpClientInputSchema = z34.object({
+  routerId: z34.string().describe("Target router identifier from the router registry"),
+  action: z34.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  interface: z34.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
+  usePeerDns: z34.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
+  usePeerNtp: z34.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
+  addDefaultRoute: z34.boolean().default(true).describe("Add default route from DHCP (add only)"),
+  comment: z34.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun: z34.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageDhcpClientTool = {
   name: "manage_dhcp_client",
@@ -7528,7 +8251,7 @@ var manageDhcpClientTool = {
   snapshotPaths: ["ip/dhcp-client"],
   async handler(params, context) {
     const parsed = manageDhcpClientInputSchema.parse(params);
-    log34.info({ routerId: context.routerId, action: parsed.action, interface: parsed.interface }, "Managing DHCP client");
+    log35.info({ routerId: context.routerId, action: parsed.action, interface: parsed.interface }, "Managing DHCP client");
     try {
       const allClients = await context.routerClient.get("ip/dhcp-client", {
         limit: void 0,
@@ -7564,7 +8287,7 @@ var manageDhcpClientTool = {
         };
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("ip/dhcp-client", body);
-        log34.info({ interface: parsed.interface, id: created[".id"] }, "DHCP client added");
+        log35.info({ interface: parsed.interface, id: created[".id"] }, "DHCP client added");
         return {
           content: `Added DHCP client on "${parsed.interface}".`,
           structuredContent: { action: "created", client: created }
@@ -7587,7 +8310,7 @@ var manageDhcpClientTool = {
           };
         }
         await context.routerClient.remove("ip/dhcp-client", existing[".id"]);
-        log34.info({ interface: parsed.interface }, "DHCP client removed");
+        log35.info({ interface: parsed.interface }, "DHCP client removed");
         return {
           content: `Removed DHCP client on "${parsed.interface}".`,
           structuredContent: { action: "removed", interface: parsed.interface, id: existing[".id"] }
@@ -7624,7 +8347,7 @@ var manageDhcpClientTool = {
       const disabledValue = parsed.action === "disable" ? "true" : "false";
       await context.routerClient.update("ip/dhcp-client", existing[".id"], { disabled: disabledValue });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log34.info({ interface: parsed.interface, action: resultAction }, "DHCP client updated");
+      log35.info({ interface: parsed.interface, action: resultAction }, "DHCP client updated");
       return {
         content: `DHCP client on "${parsed.interface}" ${resultAction}.`,
         structuredContent: { action: resultAction, interface: parsed.interface, id: existing[".id"] }
@@ -7638,13 +8361,13 @@ var manageDhcpClientTool = {
 var dhcpClientTools = [listDhcpClientsTool, manageDhcpClientTool];
 
 // src/domain/tools/ip-service-tools.ts
-import { z as z34 } from "zod";
-var log35 = createLogger("ip-service-tools");
+import { z as z35 } from "zod";
+var log36 = createLogger("ip-service-tools");
 var SERVICE_NAMES = ["api", "api-ssl", "ssh", "telnet", "www", "www-ssl", "winbox", "ftp"];
-var listIpServicesInputSchema = z34.object({
-  routerId: z34.string().describe("Target router identifier from the router registry"),
-  name: z34.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
-  enabled: z34.boolean().optional().describe("When true, return only enabled services; when false, only disabled services")
+var listIpServicesInputSchema = z35.object({
+  routerId: z35.string().describe("Target router identifier from the router registry"),
+  name: z35.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  enabled: z35.boolean().optional().describe("When true, return only enabled services; when false, only disabled services")
 }).strict();
 var listIpServicesTool = {
   name: "list_ip_services",
@@ -7659,7 +8382,7 @@ var listIpServicesTool = {
   },
   async handler(params, context) {
     const parsed = listIpServicesInputSchema.parse(params);
-    log35.info({ routerId: context.routerId }, "Listing IP services");
+    log36.info({ routerId: context.routerId }, "Listing IP services");
     try {
       const allServices = await context.routerClient.get("ip/service", {
         limit: void 0,
@@ -7694,13 +8417,13 @@ var listIpServicesTool = {
     }
   }
 };
-var manageIpServiceInputSchema = z34.object({
-  routerId: z34.string().describe("Target router identifier from the router registry"),
-  action: z34.enum(["enable", "disable"]).describe(
+var manageIpServiceInputSchema = z35.object({
+  routerId: z35.string().describe("Target router identifier from the router registry"),
+  action: z35.enum(["enable", "disable"]).describe(
     "Action to perform \u2014 only enable/disable to prevent accidental lockout from changing ports"
   ),
-  name: z34.enum(SERVICE_NAMES).describe("Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
-  dryRun: z34.boolean().default(false).describe("Preview changes without applying")
+  name: z35.enum(SERVICE_NAMES).describe("Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  dryRun: z35.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageIpServiceTool = {
   name: "manage_ip_service",
@@ -7715,7 +8438,7 @@ var manageIpServiceTool = {
   },
   async handler(params, context) {
     const parsed = manageIpServiceInputSchema.parse(params);
-    log35.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP service");
+    log36.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP service");
     try {
       const allServices = await context.routerClient.get("ip/service", {
         limit: void 0,
@@ -7762,7 +8485,7 @@ var manageIpServiceTool = {
       const disabledValue = parsed.action === "disable" ? "true" : "false";
       await context.routerClient.update("ip/service", existing[".id"], { disabled: disabledValue });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
-      log35.info({ name: parsed.name, action: resultAction }, "IP service updated");
+      log36.info({ name: parsed.name, action: resultAction }, "IP service updated");
       return {
         content: `IP service "${parsed.name}" ${resultAction}.`,
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
@@ -7776,15 +8499,15 @@ var manageIpServiceTool = {
 var ipServiceTools = [listIpServicesTool, manageIpServiceTool];
 
 // src/domain/tools/pppoe-tools.ts
-import { z as z35 } from "zod";
-var log36 = createLogger("pppoe-tools");
+import { z as z36 } from "zod";
+var log37 = createLogger("pppoe-tools");
 var PPPOE_PATH = "interface/pppoe-client";
-var listPppoeClientsInputSchema = z35.object({
-  routerId: z35.string().describe("Target router identifier from the router registry"),
-  interface: z35.string().optional().describe("Filter by parent interface name (exact match)"),
-  status: z35.enum(["connected", "disconnected", "all"]).default("all").describe("Filter by running status"),
-  limit: z35.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z35.number().int().min(0).default(0).describe("Offset for pagination")
+var listPppoeClientsInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry"),
+  interface: z36.string().optional().describe("Filter by parent interface name (exact match)"),
+  status: z36.enum(["connected", "disconnected", "all"]).default("all").describe("Filter by running status"),
+  limit: z36.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z36.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 function isRunning(record) {
   return record.running === true || record.running === "true";
@@ -7802,7 +8525,7 @@ var listPppoeClientsTool = {
   },
   async handler(params, context) {
     const parsed = listPppoeClientsInputSchema.parse(params);
-    log36.info({ routerId: context.routerId }, "Listing PPPoE clients");
+    log37.info({ routerId: context.routerId }, "Listing PPPoE clients");
     try {
       const allClients = await context.routerClient.get(PPPOE_PATH, {
         limit: void 0,
@@ -7846,17 +8569,17 @@ var listPppoeClientsTool = {
     }
   }
 };
-var managePppoeClientInputSchema = z35.object({
-  routerId: z35.string().describe("Target router identifier from the router registry"),
-  action: z35.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z35.string().describe("PPPoE client interface name \u2014 idempotency key (e.g. pppoe-wan)"),
-  interface: z35.string().optional().describe("Parent interface (required for add)"),
-  user: z35.string().optional().describe("PPPoE username (required for add)"),
-  password: z35.string().optional().describe("PPPoE password (never logged)"),
-  serviceName: z35.string().optional().describe("PPPoE service name filter (leave empty to match any)"),
-  addDefaultRoute: z35.boolean().optional().describe("Add default route via PPPoE (yes/no)"),
-  dialOnDemand: z35.boolean().optional().describe("Dial on demand instead of always-on (yes/no)"),
-  dryRun: z35.boolean().default(false).describe("Preview changes without applying")
+var managePppoeClientInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry"),
+  action: z36.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z36.string().describe("PPPoE client interface name \u2014 idempotency key (e.g. pppoe-wan)"),
+  interface: z36.string().optional().describe("Parent interface (required for add)"),
+  user: z36.string().optional().describe("PPPoE username (required for add)"),
+  password: z36.string().optional().describe("PPPoE password (never logged)"),
+  serviceName: z36.string().optional().describe("PPPoE service name filter (leave empty to match any)"),
+  addDefaultRoute: z36.boolean().optional().describe("Add default route via PPPoE (yes/no)"),
+  dialOnDemand: z36.boolean().optional().describe("Dial on demand instead of always-on (yes/no)"),
+  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var managePppoeClientTool = {
   name: "manage_pppoe_client",
@@ -7872,7 +8595,7 @@ var managePppoeClientTool = {
   snapshotPaths: [PPPOE_PATH],
   async handler(params, context) {
     const parsed = managePppoeClientInputSchema.parse(params);
-    log36.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPPoE client");
+    log37.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPPoE client");
     try {
       const allClients = await context.routerClient.get(PPPOE_PATH, {
         limit: void 0,
@@ -7959,7 +8682,7 @@ var managePppoeClientTool = {
         if (parsed.addDefaultRoute !== void 0) body["add-default-route"] = parsed.addDefaultRoute ? "yes" : "no";
         if (parsed.dialOnDemand !== void 0) body["dial-on-demand"] = parsed.dialOnDemand ? "yes" : "no";
         const created = await context.routerClient.create(PPPOE_PATH, body);
-        log36.info({ name: parsed.name, id: created[".id"] }, "PPPoE client created");
+        log37.info({ name: parsed.name, id: created[".id"] }, "PPPoE client created");
         return {
           content: `Created PPPoE client "${parsed.name}" on "${parsed.interface}".`,
           structuredContent: { action: "created", client: created }
@@ -8024,7 +8747,7 @@ var managePppoeClientTool = {
           };
         }
         await context.routerClient.update(PPPOE_PATH, existing[".id"], updates);
-        log36.info({ name: parsed.name }, "PPPoE client updated");
+        log37.info({ name: parsed.name }, "PPPoE client updated");
         return {
           content: `Updated PPPoE client "${parsed.name}".`,
           structuredContent: { action: "updated", name: parsed.name, diff }
@@ -8046,7 +8769,7 @@ var managePppoeClientTool = {
         };
       }
       await context.routerClient.remove(PPPOE_PATH, existing[".id"]);
-      log36.info({ name: parsed.name }, "PPPoE client removed");
+      log37.info({ name: parsed.name }, "PPPoE client removed");
       return {
         content: `Removed PPPoE client "${parsed.name}".`,
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
@@ -8060,14 +8783,14 @@ var managePppoeClientTool = {
 var pppoeTools = [listPppoeClientsTool, managePppoeClientTool];
 
 // src/domain/tools/ovpn-tools.ts
-import { z as z36 } from "zod";
-var log37 = createLogger("ovpn-tools");
+import { z as z37 } from "zod";
+var log38 = createLogger("ovpn-tools");
 var OVPN_CLIENT_PATH = "interface/ovpn-client";
 var OVPN_SERVER_PATH = "interface/ovpn-server/server";
-var listOvpnClientsInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry"),
-  limit: z36.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z36.number().int().min(0).default(0).describe("Offset for pagination")
+var listOvpnClientsInputSchema = z37.object({
+  routerId: z37.string().describe("Target router identifier from the router registry"),
+  limit: z37.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z37.number().int().min(0).default(0).describe("Offset for pagination")
 }).strict();
 var listOvpnClientsTool = {
   name: "list_ovpn_clients",
@@ -8082,7 +8805,7 @@ var listOvpnClientsTool = {
   },
   async handler(params, context) {
     const parsed = listOvpnClientsInputSchema.parse(params);
-    log37.info({ routerId: context.routerId }, "Listing OpenVPN clients");
+    log38.info({ routerId: context.routerId }, "Listing OpenVPN clients");
     try {
       const allClients = await context.routerClient.get(OVPN_CLIENT_PATH, {
         limit: void 0,
@@ -8107,18 +8830,18 @@ var listOvpnClientsTool = {
     }
   }
 };
-var manageOvpnClientInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry"),
-  action: z36.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z36.string().describe("OpenVPN client interface name \u2014 idempotency key"),
-  connectTo: z36.string().optional().describe("Remote server address (required for add)"),
-  port: z36.number().int().min(1).max(65535).optional().describe("Remote port number"),
-  mode: z36.enum(["ip", "ethernet"]).optional().describe("Tunnel mode"),
-  protocol: z36.enum(["tcp-client", "udp"]).optional().describe("Transport protocol"),
-  certificate: z36.string().optional().describe("Client certificate name"),
-  user: z36.string().optional().describe("VPN username"),
-  password: z36.string().optional().describe("VPN password (never logged)"),
-  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
+var manageOvpnClientInputSchema = z37.object({
+  routerId: z37.string().describe("Target router identifier from the router registry"),
+  action: z37.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z37.string().describe("OpenVPN client interface name \u2014 idempotency key"),
+  connectTo: z37.string().optional().describe("Remote server address (required for add)"),
+  port: z37.number().int().min(1).max(65535).optional().describe("Remote port number"),
+  mode: z37.enum(["ip", "ethernet"]).optional().describe("Tunnel mode"),
+  protocol: z37.enum(["tcp-client", "udp"]).optional().describe("Transport protocol"),
+  certificate: z37.string().optional().describe("Client certificate name"),
+  user: z37.string().optional().describe("VPN username"),
+  password: z37.string().optional().describe("VPN password (never logged)"),
+  dryRun: z37.boolean().default(false).describe("Preview changes without applying")
 }).strict();
 var manageOvpnClientTool = {
   name: "manage_ovpn_client",
@@ -8134,7 +8857,7 @@ var manageOvpnClientTool = {
   snapshotPaths: [OVPN_CLIENT_PATH],
   async handler(params, context) {
     const parsed = manageOvpnClientInputSchema.parse(params);
-    log37.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing OpenVPN client");
+    log38.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing OpenVPN client");
     try {
       const allClients = await context.routerClient.get(OVPN_CLIENT_PATH, {
         limit: void 0,
@@ -8199,7 +8922,7 @@ var manageOvpnClientTool = {
         if (parsed.user !== void 0) body.user = parsed.user;
         if (parsed.password !== void 0) body.password = parsed.password;
         const created = await context.routerClient.create(OVPN_CLIENT_PATH, body);
-        log37.info({ name: parsed.name, id: created[".id"] }, "OpenVPN client created");
+        log38.info({ name: parsed.name, id: created[".id"] }, "OpenVPN client created");
         return {
           content: `Created OpenVPN client "${parsed.name}" connecting to "${parsed.connectTo}".`,
           structuredContent: { action: "created", client: created }
@@ -8208,275 +8931,1728 @@ var manageOvpnClientTool = {
       if (parsed.action === "update") {
         if (!existing) {
           throw new MikroMCPError({
-            category: "NOT_FOUND" /* NOT_FOUND */,
-            code: "OVPN_CLIENT_NOT_FOUND",
-            message: `OpenVPN client "${parsed.name}" not found.`,
-            details: { name: parsed.name },
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "OVPN_CLIENT_NOT_FOUND",
+            message: `OpenVPN client "${parsed.name}" not found.`,
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify with list_ovpn_clients.",
+              alternativeTools: ["list_ovpn_clients"]
+            }
+          });
+        }
+        const updates = {};
+        const diff = [];
+        if (parsed.connectTo !== void 0 && existing["connect-to"] !== parsed.connectTo) {
+          updates["connect-to"] = parsed.connectTo;
+          diff.push({ property: "connect-to", before: existing["connect-to"] ?? null, after: parsed.connectTo });
+        }
+        if (parsed.port !== void 0 && existing.port !== String(parsed.port)) {
+          updates.port = String(parsed.port);
+          diff.push({ property: "port", before: existing.port ?? null, after: String(parsed.port) });
+        }
+        if (parsed.mode !== void 0 && existing.mode !== parsed.mode) {
+          updates.mode = parsed.mode;
+          diff.push({ property: "mode", before: existing.mode ?? null, after: parsed.mode });
+        }
+        if (parsed.protocol !== void 0 && existing.protocol !== parsed.protocol) {
+          updates.protocol = parsed.protocol;
+          diff.push({ property: "protocol", before: existing.protocol ?? null, after: parsed.protocol });
+        }
+        if (parsed.certificate !== void 0 && existing.certificate !== parsed.certificate) {
+          updates.certificate = parsed.certificate;
+          diff.push({ property: "certificate", before: existing.certificate ?? null, after: parsed.certificate });
+        }
+        if (parsed.user !== void 0 && existing.user !== parsed.user) {
+          updates.user = parsed.user;
+          diff.push({ property: "user", before: existing.user ?? null, after: parsed.user });
+        }
+        if (parsed.password !== void 0) {
+          updates.password = parsed.password;
+        }
+        const hasUpdates = Object.keys(updates).length > 0;
+        if (!hasUpdates) {
+          return {
+            content: `OpenVPN client "${parsed.name}" already matches the requested configuration. No changes made.`,
+            structuredContent: { action: "no_change", client: existing }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would update OpenVPN client "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        await context.routerClient.update(OVPN_CLIENT_PATH, existing[".id"], updates);
+        log38.info({ name: parsed.name }, "OpenVPN client updated");
+        return {
+          content: `Updated OpenVPN client "${parsed.name}".`,
+          structuredContent: { action: "updated", name: parsed.name, diff }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `OpenVPN client "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove OpenVPN client "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove(OVPN_CLIENT_PATH, existing[".id"]);
+      log38.info({ name: parsed.name }, "OpenVPN client removed");
+      return {
+        content: `Removed OpenVPN client "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_client" });
+    }
+  }
+};
+var getOvpnServerInputSchema = z37.object({
+  routerId: z37.string().describe("Target router identifier from the router registry")
+}).strict();
+function fetchOvpnServer(allRecords, routerId) {
+  if (allRecords.length === 0) {
+    throw new MikroMCPError({
+      category: "NOT_FOUND" /* NOT_FOUND */,
+      code: "OVPN_SERVER_NOT_FOUND",
+      message: "OpenVPN server not found. The OpenVPN package may not be installed on this router.",
+      details: { routerId },
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Install the OpenVPN package via manage_package.",
+        alternativeTools: ["list_packages", "manage_package"]
+      }
+    });
+  }
+  return allRecords[0];
+}
+var getOvpnServerTool = {
+  name: "get_ovpn_server",
+  title: "Get OpenVPN Server",
+  description: "Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.",
+  inputSchema: getOvpnServerInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = getOvpnServerInputSchema.parse(params);
+    log38.info({ routerId: context.routerId }, "Getting OpenVPN server configuration");
+    try {
+      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const server = fetchOvpnServer(records, parsed.routerId);
+      return {
+        content: `OpenVPN server on ${context.routerId}: enabled=${server.enabled}, port=${server.port}, protocol=${server.protocol}`,
+        structuredContent: { routerId: context.routerId, server }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "get_ovpn_server" });
+    }
+  }
+};
+var manageOvpnServerInputSchema = z37.object({
+  routerId: z37.string().describe("Target router identifier from the router registry"),
+  action: z37.enum(["enable", "disable", "set"]).describe("Action to perform"),
+  port: z37.number().int().min(1).max(65535).optional().describe("Listening port (set action only)"),
+  mode: z37.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
+  protocol: z37.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
+  certificate: z37.string().optional().describe("Server certificate name (set action only)"),
+  cipher: z37.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
+  auth: z37.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
+  dryRun: z37.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageOvpnServerTool = {
+  name: "manage_ovpn_server",
+  title: "Manage OpenVPN Server",
+  description: "Enable, disable, or configure the OpenVPN server on a MikroTik router. The server is a singleton \u2014 there is only one per router. Throws NOT_FOUND if the OpenVPN package is not installed. For set action, at least one configuration field must be provided.",
+  inputSchema: manageOvpnServerInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: [OVPN_SERVER_PATH],
+  async handler(params, context) {
+    const parsed = manageOvpnServerInputSchema.parse(params);
+    log38.info({ routerId: context.routerId, action: parsed.action }, "Managing OpenVPN server");
+    try {
+      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const server = fetchOvpnServer(records, parsed.routerId);
+      const serverId = server[".id"];
+      if (parsed.action === "enable" || parsed.action === "disable") {
+        const desiredEnabled = parsed.action === "enable";
+        const currentEnabled = server.enabled === "yes";
+        if (desiredEnabled === currentEnabled) {
+          return {
+            content: `OpenVPN server on ${context.routerId} is already ${parsed.action}d. No changes made.`,
+            structuredContent: { action: "no_change", server }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would ${parsed.action} OpenVPN server on ${context.routerId}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "enabled", before: server.enabled, after: desiredEnabled ? "yes" : "no" }]
+            }
+          };
+        }
+        await context.routerClient.update(OVPN_SERVER_PATH, serverId, {
+          enabled: desiredEnabled ? "yes" : "no"
+        });
+        log38.info({ routerId: context.routerId, action: parsed.action }, "OpenVPN server updated");
+        return {
+          content: `OpenVPN server on ${context.routerId} ${parsed.action}d.`,
+          structuredContent: { action: parsed.action === "enable" ? "enabled" : "disabled", server }
+        };
+      }
+      const hasFields = parsed.port !== void 0 || parsed.mode !== void 0 || parsed.protocol !== void 0 || parsed.certificate !== void 0 || parsed.cipher !== void 0 || parsed.auth !== void 0;
+      if (!hasFields) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: "OVPN_SERVER_NO_FIELDS",
+          message: "At least one field must be provided for action set.",
+          details: {},
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Provide at least one of: port, mode, protocol, certificate, cipher, auth.",
+            alternativeTools: []
+          }
+        });
+      }
+      const updates = {};
+      const diff = [];
+      if (parsed.port !== void 0 && server.port !== String(parsed.port)) {
+        updates.port = String(parsed.port);
+        diff.push({ property: "port", before: server.port ?? null, after: String(parsed.port) });
+      }
+      if (parsed.mode !== void 0 && server.mode !== parsed.mode) {
+        updates.mode = parsed.mode;
+        diff.push({ property: "mode", before: server.mode ?? null, after: parsed.mode });
+      }
+      if (parsed.protocol !== void 0 && server.protocol !== parsed.protocol) {
+        updates.protocol = parsed.protocol;
+        diff.push({ property: "protocol", before: server.protocol ?? null, after: parsed.protocol });
+      }
+      if (parsed.certificate !== void 0 && server.certificate !== parsed.certificate) {
+        updates.certificate = parsed.certificate;
+        diff.push({ property: "certificate", before: server.certificate ?? null, after: parsed.certificate });
+      }
+      if (parsed.cipher !== void 0 && server.cipher !== parsed.cipher) {
+        updates.cipher = parsed.cipher;
+        diff.push({ property: "cipher", before: server.cipher ?? null, after: parsed.cipher });
+      }
+      if (parsed.auth !== void 0 && server.auth !== parsed.auth) {
+        updates.auth = parsed.auth;
+        diff.push({ property: "auth", before: server.auth ?? null, after: parsed.auth });
+      }
+      if (Object.keys(updates).length === 0) {
+        return {
+          content: `OpenVPN server on ${context.routerId} already matches the requested configuration. No changes made.`,
+          structuredContent: { action: "no_change", server }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would update OpenVPN server on ${context.routerId}.`,
+          structuredContent: { action: "dry_run", diff }
+        };
+      }
+      await context.routerClient.update(OVPN_SERVER_PATH, serverId, updates);
+      log38.info({ routerId: context.routerId }, "OpenVPN server configuration updated");
+      return {
+        content: `Updated OpenVPN server configuration on ${context.routerId}.`,
+        structuredContent: { action: "updated", diff }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_server" });
+    }
+  }
+};
+var ovpnTools = [
+  listOvpnClientsTool,
+  manageOvpnClientTool,
+  getOvpnServerTool,
+  manageOvpnServerTool
+];
+
+// src/domain/tools/ppp-tools.ts
+import { z as z38 } from "zod";
+var log39 = createLogger("ppp-tools");
+var listPppProfilesInputSchema = z38.object({
+  routerId: z38.string().describe("Target router identifier from the router registry"),
+  name: z38.string().optional().describe("Filter by profile name (exact match)"),
+  limit: z38.number().int().min(1).max(500).default(100).describe("Maximum profiles to return")
+}).strict();
+var listPppProfilesTool = {
+  name: "list_ppp_profiles",
+  title: "List PPP Profiles",
+  description: "List PPP profiles including the built-in default and default-encryption profiles.",
+  inputSchema: listPppProfilesInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = listPppProfilesInputSchema.parse(params);
+    try {
+      log39.info({ routerId: context.routerId }, "Listing PPP profiles");
+      const all = await context.routerClient.get("ppp/profile", { limit: void 0, offset: void 0 });
+      const filtered = parsed.name ? all.filter((p) => p.name === parsed.name) : all;
+      const profiles = filtered.slice(0, parsed.limit);
+      return {
+        content: `PPP profiles on ${context.routerId}: ${profiles.length} returned`,
+        structuredContent: { routerId: context.routerId, profiles, total: all.length, returned: profiles.length }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "list_ppp_profiles" });
+    }
+  }
+};
+var managePppProfileInputSchema = z38.object({
+  routerId: z38.string().describe("Target router identifier from the router registry"),
+  action: z38.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z38.string().describe("Profile name \u2014 idempotency key"),
+  localAddress: z38.string().optional().describe("Local IP assigned to router end of PPP link"),
+  remoteAddress: z38.string().optional().describe("IP or pool name assigned to client"),
+  dnsServer: z38.string().optional().describe("DNS server IP pushed to client"),
+  rateLimit: z38.string().optional().describe("Rate limit string (e.g. '10M/10M')"),
+  sessionTimeout: z38.string().optional().describe("Session timeout duration string (e.g. '1h')"),
+  comment: z38.string().optional().describe("Optional comment"),
+  dryRun: z38.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var managePppProfileTool = {
+  name: "manage_ppp_profile",
+  title: "Manage PPP Profile",
+  description: "Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed \u2014 RouterOS blocks this and the error is surfaced.",
+  inputSchema: managePppProfileInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  snapshotPaths: ["ppp/profile"],
+  async handler(params, context) {
+    const parsed = managePppProfileInputSchema.parse(params);
+    log39.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPP profile");
+    try {
+      const all = await context.routerClient.get("ppp/profile", { limit: void 0, offset: void 0 });
+      const existing = all.find((p) => p.name === parsed.name);
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `PPP profile "${parsed.name}" already exists. No changes made.`,
+            structuredContent: { action: "already_exists", name: parsed.name }
+          };
+        }
+        if (parsed.dryRun) {
+          const diff = [
+            { property: "name", before: null, after: parsed.name }
+          ];
+          if (parsed.localAddress) diff.push({ property: "local-address", before: null, after: parsed.localAddress });
+          if (parsed.remoteAddress) diff.push({ property: "remote-address", before: null, after: parsed.remoteAddress });
+          if (parsed.dnsServer) diff.push({ property: "dns-server", before: null, after: parsed.dnsServer });
+          if (parsed.rateLimit) diff.push({ property: "rate-limit", before: null, after: parsed.rateLimit });
+          if (parsed.sessionTimeout) diff.push({ property: "session-timeout", before: null, after: parsed.sessionTimeout });
+          if (parsed.comment) diff.push({ property: "comment", before: null, after: parsed.comment });
+          return {
+            content: `Dry run: Would create PPP profile "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        const body = { name: parsed.name };
+        if (parsed.localAddress) body["local-address"] = parsed.localAddress;
+        if (parsed.remoteAddress) body["remote-address"] = parsed.remoteAddress;
+        if (parsed.dnsServer) body["dns-server"] = parsed.dnsServer;
+        if (parsed.rateLimit) body["rate-limit"] = parsed.rateLimit;
+        if (parsed.sessionTimeout) body["session-timeout"] = parsed.sessionTimeout;
+        if (parsed.comment) body.comment = parsed.comment;
+        const created = await context.routerClient.create("ppp/profile", body);
+        log39.info({ name: parsed.name, id: created[".id"] }, "PPP profile created");
+        return {
+          content: `Created PPP profile "${parsed.name}".`,
+          structuredContent: { action: "created", name: parsed.name, id: created[".id"] }
+        };
+      }
+      if (parsed.action === "update") {
+        if (!existing) {
+          throw new MikroMCPError({
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "PPP_PROFILE_NOT_FOUND",
+            message: `PPP profile "${parsed.name}" not found.`,
+            details: { name: parsed.name },
+            recoverability: { retryable: false, suggestedAction: "Verify with list_ppp_profiles.", alternativeTools: ["list_ppp_profiles"] }
+          });
+        }
+        const changes = {};
+        const diff = [];
+        if (parsed.localAddress !== void 0 && existing["local-address"] !== parsed.localAddress) {
+          changes["local-address"] = parsed.localAddress;
+          diff.push({ property: "local-address", before: existing["local-address"] ?? null, after: parsed.localAddress });
+        }
+        if (parsed.remoteAddress !== void 0 && existing["remote-address"] !== parsed.remoteAddress) {
+          changes["remote-address"] = parsed.remoteAddress;
+          diff.push({ property: "remote-address", before: existing["remote-address"] ?? null, after: parsed.remoteAddress });
+        }
+        if (parsed.dnsServer !== void 0 && existing["dns-server"] !== parsed.dnsServer) {
+          changes["dns-server"] = parsed.dnsServer;
+          diff.push({ property: "dns-server", before: existing["dns-server"] ?? null, after: parsed.dnsServer });
+        }
+        if (parsed.rateLimit !== void 0 && existing["rate-limit"] !== parsed.rateLimit) {
+          changes["rate-limit"] = parsed.rateLimit;
+          diff.push({ property: "rate-limit", before: existing["rate-limit"] ?? null, after: parsed.rateLimit });
+        }
+        if (parsed.sessionTimeout !== void 0 && existing["session-timeout"] !== parsed.sessionTimeout) {
+          changes["session-timeout"] = parsed.sessionTimeout;
+          diff.push({ property: "session-timeout", before: existing["session-timeout"] ?? null, after: parsed.sessionTimeout });
+        }
+        if (parsed.comment !== void 0 && existing.comment !== parsed.comment) {
+          changes.comment = parsed.comment;
+          diff.push({ property: "comment", before: existing.comment ?? null, after: parsed.comment });
+        }
+        if (Object.keys(changes).length === 0) {
+          return {
+            content: `PPP profile "${parsed.name}" already matches requested values. No changes made.`,
+            structuredContent: { action: "no_change", name: parsed.name }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would update PPP profile "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        await context.routerClient.update("ppp/profile", existing[".id"], changes);
+        log39.info({ name: parsed.name, id: existing[".id"] }, "PPP profile updated");
+        return {
+          content: `Updated PPP profile "${parsed.name}".`,
+          structuredContent: { action: "updated", name: parsed.name, id: existing[".id"], diff }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `PPP profile "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove PPP profile "${parsed.name}".`,
+          structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
+        };
+      }
+      await context.routerClient.remove("ppp/profile", existing[".id"]);
+      log39.info({ name: parsed.name }, "PPP profile removed");
+      return {
+        content: `Removed PPP profile "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ppp_profile" });
+    }
+  }
+};
+var pppTools = [listPppProfilesTool, managePppProfileTool];
+
+// src/domain/tools/upgrade-tools.ts
+import { z as z39 } from "zod";
+var log40 = createLogger("upgrade-tools");
+var getUpgradeStatusInputSchema = z39.object({
+  routerId: z39.string().describe("Target router identifier from the router registry")
+}).strict();
+var getUpgradeStatusTool = {
+  name: "get_upgrade_status",
+  title: "Get Upgrade Status",
+  description: "Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.",
+  inputSchema: getUpgradeStatusInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = getUpgradeStatusInputSchema.parse(params);
+    log40.info({ routerId: context.routerId }, "Getting upgrade status");
+    try {
+      const [updateResults, routerboardResults] = await Promise.all([
+        context.routerClient.get("system/package/update"),
+        context.routerClient.get("system/routerboard")
+      ]);
+      const update = updateResults[0] ?? {};
+      const routerboard = routerboardResults.length > 0 ? routerboardResults[0] : null;
+      return {
+        content: `Upgrade status on ${parsed.routerId}: installed=${update["installed-version"] ?? "?"} latest=${update["latest-version"] ?? "?"} (${update.status ?? "unknown"})`,
+        structuredContent: {
+          routerId: parsed.routerId,
+          channel: update.channel ?? null,
+          installedVersion: update["installed-version"] ?? null,
+          latestVersion: update["latest-version"] ?? null,
+          status: update.status ?? null,
+          routerboard: routerboard ? {
+            model: routerboard.model ?? null,
+            currentFirmware: routerboard["current-firmware"] ?? null,
+            upgradeFirmware: routerboard["upgrade-firmware"] ?? null,
+            factoryFirmware: routerboard["factory-firmware"] ?? null
+          } : null
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "get_upgrade_status" });
+    }
+  }
+};
+var manageUpgradeInputSchema = z39.object({
+  routerId: z39.string().describe("Target router identifier from the router registry"),
+  action: z39.enum(["check", "install"]).describe(
+    "check \u2014 trigger a check for available updates; install \u2014 download and install the latest update (triggers reboot)"
+  ),
+  dryRun: z39.boolean().default(false).describe("Preview the action without executing")
+}).strict();
+var manageUpgradeTool = {
+  name: "manage_upgrade",
+  title: "Manage Upgrade",
+  description: "Trigger a RouterOS package update check or install. 'check' queries the update server for new packages. 'install' downloads and applies the update \u2014 the router will reboot automatically. Supports dry-run.",
+  inputSchema: manageUpgradeInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = manageUpgradeInputSchema.parse(params);
+    log40.info({ routerId: context.routerId, action: parsed.action }, "Managing upgrade");
+    try {
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would execute '${parsed.action}' on ${parsed.routerId}.`,
+          structuredContent: {
+            action: "dry_run",
+            requestedAction: parsed.action,
+            routerId: parsed.routerId
+          }
+        };
+      }
+      if (parsed.action === "check") {
+        await context.routerClient.execute("system/package/update/check-for-updates");
+        log40.info({ routerId: context.routerId }, "Update check triggered");
+        return {
+          content: `Update check triggered on ${parsed.routerId}.`,
+          structuredContent: { action: "check_triggered", routerId: parsed.routerId }
+        };
+      }
+      await context.routerClient.execute("system/package/update/install");
+      log40.info({ routerId: context.routerId }, "Package install triggered");
+      return {
+        content: `Package install triggered on ${parsed.routerId}. Router will reboot automatically.`,
+        structuredContent: { action: "install_triggered", routerId: parsed.routerId }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_upgrade" });
+    }
+  }
+};
+var upgradeTools = [getUpgradeStatusTool, manageUpgradeTool];
+
+// src/domain/tools/backup-tools.ts
+import { z as z40 } from "zod";
+var log41 = createLogger("backup-tools");
+var createBackupInputSchema = z40.object({
+  routerId: z40.string().describe("Target router identifier from the router registry"),
+  name: z40.string().default("backup").describe("Backup file name (without extension)"),
+  password: z40.string().optional().describe("Password to encrypt the backup file"),
+  dryRun: z40.boolean().default(false).describe("Preview the backup without creating it")
+}).strict();
+var createBackupTool = {
+  name: "create_backup",
+  title: "Create Backup",
+  description: "Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.",
+  inputSchema: createBackupInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = createBackupInputSchema.parse(params);
+    log41.info({ routerId: context.routerId, name: parsed.name }, "Creating backup");
+    if (parsed.dryRun) {
+      return {
+        content: `Dry run: Would create backup "${parsed.name}.backup" on ${context.routerId}.`,
+        structuredContent: { action: "dry_run", name: parsed.name, routerId: context.routerId }
+      };
+    }
+    try {
+      const body = { name: parsed.name };
+      if (parsed.password !== void 0) {
+        body.password = parsed.password;
+      }
+      await context.routerClient.execute("system/backup/save", body);
+      log41.info({ routerId: context.routerId, name: parsed.name }, "Backup created");
+      return {
+        content: `Backup "${parsed.name}.backup" created on ${context.routerId}.`,
+        structuredContent: {
+          action: "created",
+          routerId: context.routerId,
+          filePath: `${parsed.name}.backup`
+        }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "create_backup" });
+    }
+  }
+};
+var exportConfigInputSchema = z40.object({
+  routerId: z40.string().describe("Target router identifier from the router registry"),
+  compact: z40.boolean().default(false).describe("Export only non-default settings (compact format)"),
+  file: z40.string().optional().describe("Save the export to a file on the router (without extension); omit to return inline")
+}).strict();
+var exportConfigTool = {
+  name: "export_config",
+  title: "Export Config",
+  description: "Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.",
+  inputSchema: exportConfigInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = exportConfigInputSchema.parse(params);
+    log41.info({ routerId: context.routerId, compact: parsed.compact }, "Exporting config");
+    try {
+      if (parsed.file !== void 0) {
+        const body = { file: parsed.file };
+        if (parsed.compact) body.compact = "yes";
+        await context.routerClient.execute("system/export", body);
+        return {
+          content: `Config exported to "${parsed.file}.rsc" on ${context.routerId}.`,
+          structuredContent: {
+            routerId: context.routerId,
+            filePath: `${parsed.file}.rsc`
+          }
+        };
+      }
+      const sshCommand = parsed.compact ? "export compact" : "export";
+      const scriptText = await context.sshClient.execute(sshCommand);
+      return {
+        content: `Config export from ${context.routerId}:
+${scriptText}`,
+        structuredContent: {
+          routerId: context.routerId,
+          script: scriptText,
+          compact: parsed.compact
+        }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "export_config" });
+    }
+  }
+};
+var backupTools = [createBackupTool, exportConfigTool];
+
+// src/domain/tools/log-tools.ts
+import { z as z41 } from "zod";
+var log42 = createLogger("log-tools");
+var LOG_RULES_PATH = "system/logging";
+var LOG_ACTIONS_PATH = "system/logging/action";
+var logActionTypeEnum = z41.enum(["memory", "disk", "remote", "echo", "email"]);
+var listLogRulesInputSchema = z41.object({
+  routerId: z41.string().describe("Target router identifier from the router registry"),
+  topics: z41.string().optional().describe("Filter by topics (substring match)"),
+  logAction: z41.string().optional().describe("Filter by log action target (exact match on action field)"),
+  limit: z41.number().int().min(1).max(500).default(100).describe("Maximum number of rules to return (1-500, default 100)")
+}).strict();
+var listLogRulesTool = {
+  name: "list_log_rules",
+  title: "List Log Rules",
+  description: "List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.",
+  inputSchema: listLogRulesInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listLogRulesInputSchema.parse(params);
+    log42.info({ routerId: context.routerId }, "Listing log rules");
+    try {
+      const all = await context.routerClient.get(LOG_RULES_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      let rules = all;
+      if (parsed.topics !== void 0) {
+        rules = rules.filter((r) => r.topics?.includes(parsed.topics));
+      }
+      if (parsed.logAction !== void 0) {
+        rules = rules.filter((r) => r.action === parsed.logAction);
+      }
+      const returned = rules.slice(0, parsed.limit);
+      return {
+        content: `Log rules on ${context.routerId}: ${returned.length} rule(s) (${all.length} total).`,
+        structuredContent: {
+          routerId: context.routerId,
+          rules: returned,
+          total: all.length,
+          returned: returned.length
+        }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "list_log_rules" });
+    }
+  }
+};
+var manageLogRuleInputSchema = z41.object({
+  routerId: z41.string().describe("Target router identifier from the router registry"),
+  action: z41.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  topics: z41.string().describe("Log topics (e.g. firewall, system, info) \u2014 idempotency key"),
+  logAction: z41.string().describe("Log action target name (RouterOS action field) \u2014 idempotency key"),
+  prefix: z41.string().optional().describe("Optional prefix to prepend to log messages"),
+  dryRun: z41.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageLogRuleTool = {
+  name: "manage_log_rule",
+  title: "Manage Log Rule",
+  description: "Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction pair. add returns already_exists if matching rule found. remove returns not_found gracefully. enable/disable throw NOT_FOUND if rule not found. Supports dry-run.",
+  inputSchema: manageLogRuleInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["system/logging"],
+  async handler(params, context) {
+    const parsed = manageLogRuleInputSchema.parse(params);
+    log42.info(
+      { routerId: context.routerId, action: parsed.action, topics: parsed.topics },
+      "Managing log rule"
+    );
+    try {
+      const all = await context.routerClient.get(LOG_RULES_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find(
+        (r) => r.topics === parsed.topics && r.action === parsed.logAction
+      );
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `Log rule for topics "${parsed.topics}" \u2192 "${parsed.logAction}" already exists.`,
+            structuredContent: {
+              action: "already_exists",
+              routerId: context.routerId,
+              id: existing[".id"]
+            }
+          };
+        }
+        const body = {
+          topics: parsed.topics,
+          action: parsed.logAction
+        };
+        if (parsed.prefix !== void 0) body.prefix = parsed.prefix;
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: Object.entries(body).map(([property, after]) => ({
+                property,
+                before: null,
+                after
+              }))
+            }
+          };
+        }
+        const created = await context.routerClient.create(LOG_RULES_PATH, body);
+        log42.info({ topics: parsed.topics, logAction: parsed.logAction, id: created[".id"] }, "Log rule added");
+        return {
+          content: `Added log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+          structuredContent: {
+            action: "created",
+            routerId: context.routerId,
+            id: created[".id"]
+          }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `Log rule for topics "${parsed.topics}" \u2192 "${parsed.logAction}" not found. No changes made.`,
+            structuredContent: {
+              action: "not_found",
+              routerId: context.routerId
+            }
+          };
+        }
+        const id = existing[".id"];
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+            structuredContent: { action: "dry_run", id }
+          };
+        }
+        await context.routerClient.remove(LOG_RULES_PATH, id);
+        log42.info({ topics: parsed.topics, logAction: parsed.logAction, id }, "Log rule removed");
+        return {
+          content: `Removed log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+          structuredContent: { action: "removed", id }
+        };
+      }
+      if (parsed.action === "enable" || parsed.action === "disable") {
+        if (!existing) {
+          throw new MikroMCPError({
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "LOG_RULE_NOT_FOUND",
+            message: `Log rule with topics "${parsed.topics}" and action "${parsed.logAction}" not found.`,
+            details: { topics: parsed.topics, logAction: parsed.logAction },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify with list_log_rules or use action=add to create it.",
+              alternativeTools: ["list_log_rules", "manage_log_rule with action=add"]
+            }
+          });
+        }
+        const id = existing[".id"];
+        const wantDisabled = parsed.action === "disable";
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would ${parsed.action} log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+            structuredContent: {
+              action: "dry_run",
+              id,
+              diff: [{ property: "disabled", before: existing.disabled ?? "false", after: String(wantDisabled) }]
+            }
+          };
+        }
+        await context.routerClient.update(LOG_RULES_PATH, id, {
+          disabled: wantDisabled ? "true" : "false"
+        });
+        const resultAction = wantDisabled ? "disabled" : "enabled";
+        log42.info({ topics: parsed.topics, id, action: resultAction }, "Log rule toggled");
+        return {
+          content: `${wantDisabled ? "Disabled" : "Enabled"} log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
+          structuredContent: { action: resultAction, id }
+        };
+      }
+      throw new MikroMCPError({
+        category: "VALIDATION" /* VALIDATION */,
+        code: "INVALID_ACTION",
+        message: `Unknown action: ${parsed.action}`,
+        recoverability: {
+          retryable: false,
+          suggestedAction: "Use one of: add, remove, enable, disable."
+        }
+      });
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_log_rule" });
+    }
+  }
+};
+var listLogActionsInputSchema = z41.object({
+  routerId: z41.string().describe("Target router identifier from the router registry"),
+  type: logActionTypeEnum.optional().describe("Filter by action type (exact match): memory, disk, remote, echo, email"),
+  limit: z41.number().int().min(1).max(500).default(100).describe("Maximum number of actions to return (1-500, default 100)")
+}).strict();
+var listLogActionsTool = {
+  name: "list_log_actions",
+  title: "List Log Actions",
+  description: "List RouterOS logging action targets (system/logging/action) with optional type filter.",
+  inputSchema: listLogActionsInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listLogActionsInputSchema.parse(params);
+    log42.info({ routerId: context.routerId }, "Listing log actions");
+    try {
+      const all = await context.routerClient.get(LOG_ACTIONS_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      let actions = all;
+      if (parsed.type !== void 0) {
+        actions = actions.filter((a) => a.type === parsed.type);
+      }
+      const returned = actions.slice(0, parsed.limit);
+      return {
+        content: `Log actions on ${context.routerId}: ${returned.length} action(s) (${all.length} total).`,
+        structuredContent: {
+          routerId: context.routerId,
+          actions: returned,
+          total: all.length,
+          returned: returned.length
+        }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "list_log_actions" });
+    }
+  }
+};
+var manageLogActionInputSchema = z41.object({
+  routerId: z41.string().describe("Target router identifier from the router registry"),
+  action: z41.enum(["add", "remove"]).describe("Action to perform"),
+  name: z41.string().describe("Log action name \u2014 idempotency key"),
+  type: logActionTypeEnum.optional().describe("Action type: memory, disk, remote, echo, email (required on add)"),
+  remote: z41.string().optional().describe("Remote syslog server address (for type=remote)"),
+  remotePort: z41.number().int().min(1).max(65535).optional().describe("Remote syslog server port (for type=remote)"),
+  diskFileName: z41.string().optional().describe("Disk log file name without extension (for type=disk)"),
+  dryRun: z41.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageLogActionTool = {
+  name: "manage_log_action",
+  title: "Manage Log Action",
+  description: "Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.",
+  inputSchema: manageLogActionInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: ["system/logging/action"],
+  async handler(params, context) {
+    const parsed = manageLogActionInputSchema.parse(params);
+    log42.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing log action"
+    );
+    try {
+      const all = await context.routerClient.get(LOG_ACTIONS_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find((a) => a.name === parsed.name);
+      if (parsed.action === "add") {
+        if (parsed.type === void 0) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "LOG_ACTION_TYPE_REQUIRED",
+            message: "type is required when action is add",
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the type field: memory, disk, remote, echo, or email."
+            }
+          });
+        }
+        if (existing) {
+          return {
+            content: `Log action "${parsed.name}" already exists.`,
+            structuredContent: {
+              action: "already_exists",
+              routerId: context.routerId,
+              name: parsed.name,
+              id: existing[".id"]
+            }
+          };
+        }
+        const body = {
+          name: parsed.name,
+          type: parsed.type
+        };
+        if (parsed.remote !== void 0) body.remote = parsed.remote;
+        if (parsed.remotePort !== void 0) body["remote-port"] = String(parsed.remotePort);
+        if (parsed.diskFileName !== void 0) body["disk-file-name"] = parsed.diskFileName;
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add log action "${parsed.name}" (type=${parsed.type}).`,
+            structuredContent: {
+              action: "dry_run",
+              diff: Object.entries(body).map(([property, after]) => ({
+                property,
+                before: null,
+                after
+              }))
+            }
+          };
+        }
+        const created = await context.routerClient.create(LOG_ACTIONS_PATH, body);
+        log42.info({ name: parsed.name, type: parsed.type, id: created[".id"] }, "Log action added");
+        return {
+          content: `Added log action "${parsed.name}" (type=${parsed.type}).`,
+          structuredContent: {
+            action: "created",
+            routerId: context.routerId,
+            name: parsed.name,
+            id: created[".id"]
+          }
+        };
+      }
+      if (parsed.action === "remove") {
+        if (!existing) {
+          return {
+            content: `Log action "${parsed.name}" not found. No changes made.`,
+            structuredContent: {
+              action: "not_found",
+              routerId: context.routerId,
+              name: parsed.name
+            }
+          };
+        }
+        const id = existing[".id"];
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would remove log action "${parsed.name}".`,
+            structuredContent: { action: "dry_run", name: parsed.name, id }
+          };
+        }
+        await context.routerClient.remove(LOG_ACTIONS_PATH, id);
+        log42.info({ name: parsed.name, id }, "Log action removed");
+        return {
+          content: `Removed log action "${parsed.name}".`,
+          structuredContent: { action: "removed", name: parsed.name, id }
+        };
+      }
+      throw new MikroMCPError({
+        category: "VALIDATION" /* VALIDATION */,
+        code: "INVALID_ACTION",
+        message: `Unknown action: ${parsed.action}`,
+        recoverability: {
+          retryable: false,
+          suggestedAction: "Use one of: add, remove."
+        }
+      });
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_log_action" });
+    }
+  }
+};
+var logTools = [
+  listLogRulesTool,
+  manageLogRuleTool,
+  listLogActionsTool,
+  manageLogActionTool
+];
+
+// src/domain/tools/network-test-tools.ts
+import { z as z42 } from "zod";
+var log43 = createLogger("network-test-tools");
+var BODY_CAP = 65536;
+var bandwidthTestInputSchema = z42.object({
+  routerId: z42.string().describe("Target router identifier from the router registry"),
+  address: z42.string().describe("Remote host running RouterOS btest server"),
+  protocol: z42.enum(["tcp", "udp"]).default("tcp").describe("Test protocol"),
+  direction: z42.enum(["send", "receive", "both"]).default("both").describe("Test direction"),
+  duration: z42.number().int().min(1).max(30).default(5).describe("Test duration in seconds (max 30)")
+}).strict();
+var bandwidthTestTool = {
+  name: "bandwidth_test",
+  title: "Bandwidth Test",
+  description: "Run a RouterOS bandwidth test from the router to a remote host running a RouterOS btest server. Returns TX and RX throughput in Mbps. Duration capped at 30 seconds.",
+  inputSchema: bandwidthTestInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = bandwidthTestInputSchema.parse(params);
+    log43.info({ routerId: context.routerId, address: parsed.address }, "Running bandwidth test");
+    try {
+      const result = await context.routerClient.execute("tool/bandwidth-test", {
+        address: parsed.address,
+        protocol: parsed.protocol,
+        direction: parsed.direction,
+        duration: String(parsed.duration)
+      });
+      const txBps = Number(result["tx-current"] ?? 0);
+      const rxBps = Number(result["rx-current"] ?? 0);
+      const txMbps = Math.round(txBps / 1e6 * 100) / 100;
+      const rxMbps = Math.round(rxBps / 1e6 * 100) / 100;
+      return {
+        content: `Bandwidth test to ${parsed.address}: TX=${txMbps} Mbps RX=${rxMbps} Mbps`,
+        structuredContent: {
+          routerId: context.routerId,
+          address: parsed.address,
+          protocol: parsed.protocol,
+          direction: parsed.direction,
+          txMbps,
+          rxMbps,
+          lostPackets: result["lost-packets"] ?? null
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "bandwidth_test" });
+    }
+  }
+};
+var fetchUrlInputSchema = z42.object({
+  routerId: z42.string().describe("Target router identifier from the router registry"),
+  url: z42.string().url().describe("URL to fetch from the router"),
+  method: z42.enum(["GET", "POST"]).default("GET").describe("HTTP method"),
+  httpData: z42.string().optional().describe("Request body for POST"),
+  outputFile: z42.string().optional().describe("Save response body to this router file path instead of returning inline")
+}).strict();
+var fetchUrlTool = {
+  name: "fetch_url",
+  title: "Fetch URL",
+  description: "Send an HTTP/HTTPS request from the router using /tool/fetch. Response body is returned inline (capped at 64 KB with [TRUNCATED] marker). Use outputFile to save to router filesystem instead.",
+  inputSchema: fetchUrlInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = fetchUrlInputSchema.parse(params);
+    log43.info({ routerId: context.routerId, url: parsed.url, method: parsed.method }, "Fetching URL");
+    try {
+      const body = { url: parsed.url, "http-method": parsed.method.toLowerCase() };
+      if (parsed.httpData) body["http-data"] = parsed.httpData;
+      if (parsed.outputFile) {
+        body.output = "file";
+        body["dst-path"] = parsed.outputFile;
+      } else {
+        body.output = "user";
+      }
+      const sections = await context.routerClient.execute("tool/fetch", body);
+      const finished = sections.find((s) => s.status === "finished") ?? sections[sections.length - 1];
+      const statusCode = finished?.code ?? null;
+      if (parsed.outputFile) {
+        return {
+          content: `Fetched ${parsed.url} \u2192 saved to ${parsed.outputFile} (status ${statusCode})`,
+          structuredContent: { routerId: context.routerId, url: parsed.url, statusCode, outputFile: parsed.outputFile }
+        };
+      }
+      let responseBody = finished?.data ?? "";
+      if (responseBody.length > BODY_CAP) {
+        responseBody = responseBody.slice(0, BODY_CAP) + "[TRUNCATED]";
+      }
+      return {
+        content: `Fetched ${parsed.url}: status=${statusCode} body_length=${responseBody.length}`,
+        structuredContent: { routerId: context.routerId, url: parsed.url, statusCode, body: responseBody }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "fetch_url" });
+    }
+  }
+};
+var listConnectionsInputSchema = z42.object({
+  routerId: z42.string().describe("Target router identifier from the router registry"),
+  srcAddress: z42.string().optional().describe("Filter by source address (substring match)"),
+  dstAddress: z42.string().optional().describe("Filter by destination address (substring match)"),
+  protocol: z42.string().optional().describe("Filter by protocol (exact match, e.g. tcp, udp, icmp)"),
+  limit: z42.number().int().min(1).max(500).default(100).describe("Maximum connections to return")
+}).strict();
+var listConnectionsTool = {
+  name: "list_connections",
+  title: "List Connections",
+  description: "List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.",
+  inputSchema: listConnectionsInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = listConnectionsInputSchema.parse(params);
+    log43.info({ routerId: context.routerId }, "Listing connections");
+    try {
+      const all = await context.routerClient.get("ip/firewall/connection", {
+        limit: void 0,
+        offset: void 0
+      });
+      const filtered = all.filter((c) => parsed.srcAddress ? (c["src-address"] ?? "").includes(parsed.srcAddress) : true).filter((c) => parsed.dstAddress ? (c["dst-address"] ?? "").includes(parsed.dstAddress) : true).filter((c) => parsed.protocol ? c.protocol === parsed.protocol : true);
+      const connections = filtered.slice(0, parsed.limit);
+      return {
+        content: `Active connections on ${context.routerId}: ${connections.length} returned (${all.length} total)`,
+        structuredContent: { routerId: context.routerId, connections, total: all.length, returned: connections.length }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_connections" });
+    }
+  }
+};
+var networkTestTools = [bandwidthTestTool, fetchUrlTool, listConnectionsTool];
+
+// src/domain/tools/container-config-tools.ts
+import { z as z43 } from "zod";
+var log44 = createLogger("container-config-tools");
+var getContainerConfigInputSchema = z43.object({ routerId: z43.string().describe("Target router identifier from the router registry") }).strict();
+var getContainerConfigTool = {
+  name: "get_container_config",
+  title: "Get Container Config",
+  description: "Read global container configuration: registry URL, RAM high-water mark, and veth interface.",
+  inputSchema: getContainerConfigInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    getContainerConfigInputSchema.parse(params);
+    log44.info({ routerId: context.routerId }, "Getting container config");
+    try {
+      const results2 = await context.routerClient.get("container/config");
+      const cfg = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
+      return {
+        content: `Container config on ${context.routerId}: registry=${cfg["registry-url"] ?? "none"} ram-high=${cfg["ram-high"] ?? "?"}MB veth=${cfg["veth-interface"] ?? "none"}`,
+        structuredContent: {
+          routerId: context.routerId,
+          registryUrl: cfg["registry-url"] ?? null,
+          ramHighMb: cfg["ram-high"] ?? null,
+          vethInterface: cfg["veth-interface"] ?? null
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "get_container_config" });
+    }
+  }
+};
+var manageContainerConfigInputSchema = z43.object({
+  routerId: z43.string().describe("Target router identifier from the router registry"),
+  registryUrl: z43.string().optional().describe("Container registry URL"),
+  ramHighMb: z43.number().int().min(1).optional().describe("RAM high-water mark in MB"),
+  vethInterface: z43.string().optional().describe("Veth interface name for container networking"),
+  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageContainerConfigTool = {
+  name: "manage_container_config",
+  title: "Manage Container Config",
+  description: "Update global container settings. Idempotent: returns no_change if nothing differs.",
+  inputSchema: manageContainerConfigInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  snapshotPaths: ["container/config"],
+  async handler(params, context) {
+    const parsed = manageContainerConfigInputSchema.parse(params);
+    log44.info({ routerId: context.routerId }, "Managing container config");
+    try {
+      const results2 = await context.routerClient.get("container/config");
+      const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
+      const id = current[".id"];
+      const changes = {};
+      const diff = [];
+      if (parsed.registryUrl !== void 0 && current["registry-url"] !== parsed.registryUrl) {
+        changes["registry-url"] = parsed.registryUrl;
+        diff.push({ property: "registry-url", before: current["registry-url"] ?? null, after: parsed.registryUrl });
+      }
+      if (parsed.ramHighMb !== void 0) {
+        const next = String(parsed.ramHighMb);
+        if (current["ram-high"] !== next) {
+          changes["ram-high"] = next;
+          diff.push({ property: "ram-high", before: current["ram-high"] ?? null, after: next });
+        }
+      }
+      if (parsed.vethInterface !== void 0 && current["veth-interface"] !== parsed.vethInterface) {
+        changes["veth-interface"] = parsed.vethInterface;
+        diff.push({ property: "veth-interface", before: current["veth-interface"] ?? null, after: parsed.vethInterface });
+      }
+      if (Object.keys(changes).length === 0) {
+        return {
+          content: "Container config already matches. No changes made.",
+          structuredContent: { action: "no_change", routerId: context.routerId }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would update container config on ${context.routerId}.`,
+          structuredContent: { action: "dry_run", diff }
+        };
+      }
+      await context.routerClient.update("container/config", id, changes);
+      log44.info({ routerId: context.routerId }, "Container config updated");
+      return {
+        content: `Updated container config on ${context.routerId}.`,
+        structuredContent: { action: "updated", routerId: context.routerId, diff }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_config" });
+    }
+  }
+};
+var listContainerEnvsInputSchema = z43.object({
+  routerId: z43.string().describe("Target router identifier from the router registry"),
+  name: z43.string().optional().describe("Filter by container name (exact match)"),
+  limit: z43.number().int().min(1).max(500).default(100).describe("Maximum entries to return")
+}).strict();
+var listContainerEnvsTool = {
+  name: "list_container_envs",
+  title: "List Container Envs",
+  description: "List container environment variable entries, optionally filtered by container name.",
+  inputSchema: listContainerEnvsInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = listContainerEnvsInputSchema.parse(params);
+    log44.info({ routerId: context.routerId }, "Listing container envs");
+    try {
+      const all = await context.routerClient.get("container/envs", {
+        limit: void 0,
+        offset: void 0
+      });
+      const filtered = parsed.name ? all.filter((e) => e.name === parsed.name) : all;
+      const envs = filtered.slice(0, parsed.limit);
+      return {
+        content: `Container envs on ${context.routerId}: ${envs.length} returned`,
+        structuredContent: { routerId: context.routerId, envs, total: all.length, returned: envs.length }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_container_envs" });
+    }
+  }
+};
+var manageContainerEnvInputSchema = z43.object({
+  routerId: z43.string().describe("Target router identifier from the router registry"),
+  action: z43.enum(["add", "remove"]).describe("Action to perform"),
+  name: z43.string().describe("Container name"),
+  key: z43.string().describe("Environment variable name \u2014 part of idempotency key"),
+  value: z43.string().optional().describe("Environment variable value (required for add)"),
+  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageContainerEnvTool = {
+  name: "manage_container_env",
+  title: "Manage Container Env",
+  description: "Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.",
+  inputSchema: manageContainerEnvInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = manageContainerEnvInputSchema.parse(params);
+    log44.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name, key: parsed.key },
+      "Managing container env"
+    );
+    try {
+      const all = await context.routerClient.get("container/envs", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find(
+        (e) => e.name === parsed.name && e.key === parsed.key
+      );
+      if (parsed.action === "add") {
+        if (existing) {
+          if (existing.value === parsed.value) {
+            return {
+              content: `Env ${parsed.name}.${parsed.key} already exists with same value.`,
+              structuredContent: { action: "already_exists", name: parsed.name, key: parsed.key }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "CONTAINER_ENV_CONFLICT",
+            message: `Env ${parsed.name}.${parsed.key} exists with a different value.`,
+            details: { existingValue: existing.value, requestedValue: parsed.value },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Remove the existing entry first.",
+              alternativeTools: ["manage_container_env"]
+            }
+          });
+        }
+        if (parsed.value === void 0) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "ENV_VALUE_REQUIRED",
+            message: "value is required for add.",
+            recoverability: { retryable: false, suggestedAction: "Provide the value parameter." }
+          });
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add env ${parsed.name}.${parsed.key}=${parsed.value}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "value", before: null, after: parsed.value }]
+            }
+          };
+        }
+        const created = await context.routerClient.create("container/envs", {
+          name: parsed.name,
+          key: parsed.key,
+          value: parsed.value
+        });
+        log44.info({ name: parsed.name, key: parsed.key, id: created[".id"] }, "Container env added");
+        return {
+          content: `Added env ${parsed.name}.${parsed.key}.`,
+          structuredContent: {
+            action: "created",
+            name: parsed.name,
+            key: parsed.key,
+            id: created[".id"]
+          }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `Env ${parsed.name}.${parsed.key} not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name, key: parsed.key }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove env ${parsed.name}.${parsed.key}.`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "key", before: parsed.key, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove("container/envs", existing[".id"]);
+      log44.info({ name: parsed.name, key: parsed.key }, "Container env removed");
+      return {
+        content: `Removed env ${parsed.name}.${parsed.key}.`,
+        structuredContent: { action: "removed", name: parsed.name, key: parsed.key }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_env" });
+    }
+  }
+};
+var listContainerMountsInputSchema = z43.object({
+  routerId: z43.string().describe("Target router identifier from the router registry"),
+  name: z43.string().optional().describe("Filter by mount name (exact match)"),
+  limit: z43.number().int().min(1).max(500).default(100).describe("Maximum entries to return")
+}).strict();
+var listContainerMountsTool = {
+  name: "list_container_mounts",
+  title: "List Container Mounts",
+  description: "List container volume mount definitions with source path, destination path, and mount name.",
+  inputSchema: listContainerMountsInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = listContainerMountsInputSchema.parse(params);
+    log44.info({ routerId: context.routerId }, "Listing container mounts");
+    try {
+      const all = await context.routerClient.get("container/mounts", {
+        limit: void 0,
+        offset: void 0
+      });
+      const filtered = parsed.name ? all.filter((m) => m.name === parsed.name) : all;
+      const mounts = filtered.slice(0, parsed.limit);
+      return {
+        content: `Container mounts on ${context.routerId}: ${mounts.length} returned`,
+        structuredContent: { routerId: context.routerId, mounts, total: all.length, returned: mounts.length }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_container_mounts" });
+    }
+  }
+};
+var manageContainerMountInputSchema = z43.object({
+  routerId: z43.string().describe("Target router identifier from the router registry"),
+  action: z43.enum(["add", "remove"]).describe("Action to perform"),
+  name: z43.string().describe("Mount name \u2014 idempotency key"),
+  src: z43.string().optional().describe("Host source path (required for add)"),
+  dst: z43.string().optional().describe("Container destination path (required for add)"),
+  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageContainerMountTool = {
+  name: "manage_container_mount",
+  title: "Manage Container Mount",
+  description: "Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.",
+  inputSchema: manageContainerMountInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = manageContainerMountInputSchema.parse(params);
+    log44.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing container mount");
+    try {
+      const all = await context.routerClient.get("container/mounts", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find((m) => m.name === parsed.name);
+      if (parsed.action === "add") {
+        if (existing) {
+          if (existing.src === parsed.src && existing.dst === parsed.dst) {
+            return {
+              content: `Mount "${parsed.name}" already exists with same paths.`,
+              structuredContent: { action: "already_exists", name: parsed.name }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "CONTAINER_MOUNT_CONFLICT",
+            message: `Mount "${parsed.name}" exists with different src/dst paths.`,
+            details: {
+              existing: { src: existing.src, dst: existing.dst },
+              requested: { src: parsed.src, dst: parsed.dst }
+            },
             recoverability: {
               retryable: false,
-              suggestedAction: "Verify with list_ovpn_clients.",
-              alternativeTools: ["list_ovpn_clients"]
+              suggestedAction: "Remove the existing mount first.",
+              alternativeTools: ["manage_container_mount"]
             }
           });
         }
-        const updates = {};
-        const diff = [];
-        if (parsed.connectTo !== void 0 && existing["connect-to"] !== parsed.connectTo) {
-          updates["connect-to"] = parsed.connectTo;
-          diff.push({ property: "connect-to", before: existing["connect-to"] ?? null, after: parsed.connectTo });
-        }
-        if (parsed.port !== void 0 && existing.port !== String(parsed.port)) {
-          updates.port = String(parsed.port);
-          diff.push({ property: "port", before: existing.port ?? null, after: String(parsed.port) });
-        }
-        if (parsed.mode !== void 0 && existing.mode !== parsed.mode) {
-          updates.mode = parsed.mode;
-          diff.push({ property: "mode", before: existing.mode ?? null, after: parsed.mode });
-        }
-        if (parsed.protocol !== void 0 && existing.protocol !== parsed.protocol) {
-          updates.protocol = parsed.protocol;
-          diff.push({ property: "protocol", before: existing.protocol ?? null, after: parsed.protocol });
-        }
-        if (parsed.certificate !== void 0 && existing.certificate !== parsed.certificate) {
-          updates.certificate = parsed.certificate;
-          diff.push({ property: "certificate", before: existing.certificate ?? null, after: parsed.certificate });
-        }
-        if (parsed.user !== void 0 && existing.user !== parsed.user) {
-          updates.user = parsed.user;
-          diff.push({ property: "user", before: existing.user ?? null, after: parsed.user });
-        }
-        if (parsed.password !== void 0) {
-          updates.password = parsed.password;
-        }
-        const hasUpdates = Object.keys(updates).length > 0;
-        if (!hasUpdates) {
-          return {
-            content: `OpenVPN client "${parsed.name}" already matches the requested configuration. No changes made.`,
-            structuredContent: { action: "no_change", client: existing }
-          };
+        if (!parsed.src || !parsed.dst) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "MOUNT_PATHS_REQUIRED",
+            message: "src and dst are required for add.",
+            recoverability: { retryable: false, suggestedAction: "Provide src and dst parameters." }
+          });
         }
         if (parsed.dryRun) {
           return {
-            content: `Dry run: Would update OpenVPN client "${parsed.name}".`,
-            structuredContent: { action: "dry_run", diff }
+            content: `Dry run: Would add mount "${parsed.name}" ${parsed.src} \u2192 ${parsed.dst}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "name", before: null, after: parsed.name }]
+            }
           };
         }
-        await context.routerClient.update(OVPN_CLIENT_PATH, existing[".id"], updates);
-        log37.info({ name: parsed.name }, "OpenVPN client updated");
+        const created = await context.routerClient.create("container/mounts", {
+          name: parsed.name,
+          src: parsed.src,
+          dst: parsed.dst
+        });
+        log44.info({ name: parsed.name, id: created[".id"] }, "Container mount added");
         return {
-          content: `Updated OpenVPN client "${parsed.name}".`,
-          structuredContent: { action: "updated", name: parsed.name, diff }
+          content: `Added mount "${parsed.name}".`,
+          structuredContent: { action: "created", name: parsed.name, id: created[".id"] }
         };
       }
       if (!existing) {
         return {
-          content: `OpenVPN client "${parsed.name}" not found. Nothing to remove.`,
+          content: `Mount "${parsed.name}" not found. Nothing to remove.`,
           structuredContent: { action: "not_found", name: parsed.name }
         };
       }
       if (parsed.dryRun) {
         return {
-          content: `Dry run: Would remove OpenVPN client "${parsed.name}".`,
+          content: `Dry run: Would remove mount "${parsed.name}".`,
           structuredContent: {
             action: "dry_run",
             diff: [{ property: "name", before: parsed.name, after: null }]
           }
         };
       }
-      await context.routerClient.remove(OVPN_CLIENT_PATH, existing[".id"]);
-      log37.info({ name: parsed.name }, "OpenVPN client removed");
+      await context.routerClient.remove("container/mounts", existing[".id"]);
+      log44.info({ name: parsed.name }, "Container mount removed");
       return {
-        content: `Removed OpenVPN client "${parsed.name}".`,
-        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+        content: `Removed mount "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name }
       };
     } catch (err) {
       if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_client" });
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_mount" });
     }
   }
 };
-var getOvpnServerInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry")
+var containerConfigTools = [
+  getContainerConfigTool,
+  manageContainerConfigTool,
+  listContainerEnvsTool,
+  manageContainerEnvTool,
+  listContainerMountsTool,
+  manageContainerMountTool
+];
+
+// src/domain/tools/interface-list-tools.ts
+import { z as z44 } from "zod";
+var log45 = createLogger("interface-list-tools");
+var listInterfaceListsInputSchema = z44.object({
+  routerId: z44.string().describe("Target router identifier from the router registry"),
+  limit: z44.number().int().min(1).max(500).default(100).describe("Maximum lists to return")
 }).strict();
-function fetchOvpnServer(allRecords, routerId) {
-  if (allRecords.length === 0) {
-    throw new MikroMCPError({
-      category: "NOT_FOUND" /* NOT_FOUND */,
-      code: "OVPN_SERVER_NOT_FOUND",
-      message: "OpenVPN server not found. The OpenVPN package may not be installed on this router.",
-      details: { routerId },
-      recoverability: {
-        retryable: false,
-        suggestedAction: "Install the OpenVPN package via manage_package.",
-        alternativeTools: ["list_packages", "manage_package"]
-      }
-    });
-  }
-  return allRecords[0];
-}
-var getOvpnServerTool = {
-  name: "get_ovpn_server",
-  title: "Get OpenVPN Server",
-  description: "Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.",
-  inputSchema: getOvpnServerInputSchema,
-  annotations: {
-    readOnlyHint: true,
-    destructiveHint: false,
-    idempotentHint: true,
-    openWorldHint: false
-  },
+var listInterfaceListsTool = {
+  name: "list_interface_lists",
+  title: "List Interface Lists",
+  description: "List all interface lists defined on the router.",
+  inputSchema: listInterfaceListsInputSchema,
+  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   async handler(params, context) {
-    const parsed = getOvpnServerInputSchema.parse(params);
-    log37.info({ routerId: context.routerId }, "Getting OpenVPN server configuration");
+    const parsed = listInterfaceListsInputSchema.parse(params);
+    log45.info({ routerId: context.routerId }, "Listing interface lists");
     try {
-      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+      const all = await context.routerClient.get("interface/list", {
         limit: void 0,
         offset: void 0
       });
-      const server = fetchOvpnServer(records, parsed.routerId);
+      const lists = all.slice(0, parsed.limit);
       return {
-        content: `OpenVPN server on ${context.routerId}: enabled=${server.enabled}, port=${server.port}, protocol=${server.protocol}`,
-        structuredContent: { routerId: context.routerId, server }
+        content: `Interface lists on ${context.routerId}: ${lists.length} returned`,
+        structuredContent: { routerId: context.routerId, lists, total: all.length, returned: lists.length }
       };
     } catch (err) {
       if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "get_ovpn_server" });
+      throw enrichError(err, { routerId: context.routerId, tool: "list_interface_lists" });
     }
   }
 };
-var manageOvpnServerInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry"),
-  action: z36.enum(["enable", "disable", "set"]).describe("Action to perform"),
-  port: z36.number().int().min(1).max(65535).optional().describe("Listening port (set action only)"),
-  mode: z36.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
-  protocol: z36.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
-  certificate: z36.string().optional().describe("Server certificate name (set action only)"),
-  cipher: z36.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
-  auth: z36.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
-  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
+var manageInterfaceListInputSchema = z44.object({
+  routerId: z44.string().describe("Target router identifier from the router registry"),
+  action: z44.enum(["add", "remove"]).describe("Action to perform"),
+  name: z44.string().describe("Interface list name \u2014 idempotency key"),
+  comment: z44.string().optional().describe("Optional comment"),
+  dryRun: z44.boolean().default(false).describe("Preview changes without applying")
 }).strict();
-var manageOvpnServerTool = {
-  name: "manage_ovpn_server",
-  title: "Manage OpenVPN Server",
-  description: "Enable, disable, or configure the OpenVPN server on a MikroTik router. The server is a singleton \u2014 there is only one per router. Throws NOT_FOUND if the OpenVPN package is not installed. For set action, at least one configuration field must be provided.",
-  inputSchema: manageOvpnServerInputSchema,
-  annotations: {
-    readOnlyHint: false,
-    destructiveHint: true,
-    idempotentHint: true,
-    openWorldHint: false
-  },
-  snapshotPaths: [OVPN_SERVER_PATH],
+var manageInterfaceListTool = {
+  name: "manage_interface_list",
+  title: "Manage Interface List",
+  description: "Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS \u2014 the error is surfaced as-is.",
+  inputSchema: manageInterfaceListInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
   async handler(params, context) {
-    const parsed = manageOvpnServerInputSchema.parse(params);
-    log37.info({ routerId: context.routerId, action: parsed.action }, "Managing OpenVPN server");
+    const parsed = manageInterfaceListInputSchema.parse(params);
+    log45.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing interface list");
     try {
-      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+      const all = await context.routerClient.get("interface/list", {
         limit: void 0,
         offset: void 0
       });
-      const server = fetchOvpnServer(records, parsed.routerId);
-      const serverId = server[".id"];
-      if (parsed.action === "enable" || parsed.action === "disable") {
-        const desiredEnabled = parsed.action === "enable";
-        const currentEnabled = server.enabled === "yes";
-        if (desiredEnabled === currentEnabled) {
+      const existing = all.find((l) => l.name === parsed.name);
+      if (parsed.action === "add") {
+        if (existing) {
           return {
-            content: `OpenVPN server on ${context.routerId} is already ${parsed.action}d. No changes made.`,
-            structuredContent: { action: "no_change", server }
+            content: `Interface list "${parsed.name}" already exists. No changes made.`,
+            structuredContent: { action: "already_exists", name: parsed.name }
           };
         }
         if (parsed.dryRun) {
           return {
-            content: `Dry run: Would ${parsed.action} OpenVPN server on ${context.routerId}.`,
+            content: `Dry run: Would create interface list "${parsed.name}".`,
             structuredContent: {
               action: "dry_run",
-              diff: [{ property: "enabled", before: server.enabled, after: desiredEnabled ? "yes" : "no" }]
+              diff: [{ property: "name", before: null, after: parsed.name }]
             }
           };
         }
-        await context.routerClient.update(OVPN_SERVER_PATH, serverId, {
-          enabled: desiredEnabled ? "yes" : "no"
-        });
-        log37.info({ routerId: context.routerId, action: parsed.action }, "OpenVPN server updated");
+        const body = { name: parsed.name };
+        if (parsed.comment) body.comment = parsed.comment;
+        const created = await context.routerClient.create("interface/list", body);
+        log45.info({ name: parsed.name, id: created[".id"] }, "Interface list created");
         return {
-          content: `OpenVPN server on ${context.routerId} ${parsed.action}d.`,
-          structuredContent: { action: parsed.action === "enable" ? "enabled" : "disabled", server }
+          content: `Created interface list "${parsed.name}".`,
+          structuredContent: { action: "created", name: parsed.name, id: created[".id"] }
         };
       }
-      const hasFields = parsed.port !== void 0 || parsed.mode !== void 0 || parsed.protocol !== void 0 || parsed.certificate !== void 0 || parsed.cipher !== void 0 || parsed.auth !== void 0;
-      if (!hasFields) {
-        throw new MikroMCPError({
-          category: "VALIDATION" /* VALIDATION */,
-          code: "OVPN_SERVER_NO_FIELDS",
-          message: "At least one field must be provided for action set.",
-          details: {},
-          recoverability: {
-            retryable: false,
-            suggestedAction: "Provide at least one of: port, mode, protocol, certificate, cipher, auth.",
-            alternativeTools: []
-          }
-        });
-      }
-      const updates = {};
-      const diff = [];
-      if (parsed.port !== void 0 && server.port !== String(parsed.port)) {
-        updates.port = String(parsed.port);
-        diff.push({ property: "port", before: server.port ?? null, after: String(parsed.port) });
-      }
-      if (parsed.mode !== void 0 && server.mode !== parsed.mode) {
-        updates.mode = parsed.mode;
-        diff.push({ property: "mode", before: server.mode ?? null, after: parsed.mode });
-      }
-      if (parsed.protocol !== void 0 && server.protocol !== parsed.protocol) {
-        updates.protocol = parsed.protocol;
-        diff.push({ property: "protocol", before: server.protocol ?? null, after: parsed.protocol });
-      }
-      if (parsed.certificate !== void 0 && server.certificate !== parsed.certificate) {
-        updates.certificate = parsed.certificate;
-        diff.push({ property: "certificate", before: server.certificate ?? null, after: parsed.certificate });
+      if (!existing) {
+        return {
+          content: `Interface list "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
       }
-      if (parsed.cipher !== void 0 && server.cipher !== parsed.cipher) {
-        updates.cipher = parsed.cipher;
-        diff.push({ property: "cipher", before: server.cipher ?? null, after: parsed.cipher });
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove interface list "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
+        };
       }
-      if (parsed.auth !== void 0 && server.auth !== parsed.auth) {
-        updates.auth = parsed.auth;
-        diff.push({ property: "auth", before: server.auth ?? null, after: parsed.auth });
+      await context.routerClient.remove("interface/list", existing[".id"]);
+      log45.info({ name: parsed.name }, "Interface list removed");
+      return {
+        content: `Removed interface list "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_interface_list" });
+    }
+  }
+};
+var manageInterfaceListMemberInputSchema = z44.object({
+  routerId: z44.string().describe("Target router identifier from the router registry"),
+  action: z44.enum(["add", "remove"]).describe("Action to perform"),
+  list: z44.string().describe("Interface list name \u2014 part of composite idempotency key"),
+  interface: z44.string().describe("Interface name to add/remove \u2014 part of composite idempotency key"),
+  comment: z44.string().optional().describe("Optional comment"),
+  dryRun: z44.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageInterfaceListMemberTool = {
+  name: "manage_interface_list_member",
+  title: "Manage Interface List Member",
+  description: "Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.",
+  inputSchema: manageInterfaceListMemberInputSchema,
+  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  async handler(params, context) {
+    const parsed = manageInterfaceListMemberInputSchema.parse(params);
+    log45.info(
+      { routerId: context.routerId, action: parsed.action, list: parsed.list, interface: parsed.interface },
+      "Managing interface list member"
+    );
+    try {
+      const all = await context.routerClient.get("interface/list/member", {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = all.find(
+        (m) => m.list === parsed.list && m.interface === parsed.interface
+      );
+      if (parsed.action === "add") {
+        if (existing) {
+          return {
+            content: `Interface "${parsed.interface}" is already a member of list "${parsed.list}". No changes made.`,
+            structuredContent: { action: "already_exists", list: parsed.list, interface: parsed.interface }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would add "${parsed.interface}" to list "${parsed.list}".`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "interface", before: null, after: parsed.interface }]
+            }
+          };
+        }
+        const body = { list: parsed.list, interface: parsed.interface };
+        if (parsed.comment) body.comment = parsed.comment;
+        const created = await context.routerClient.create("interface/list/member", body);
+        log45.info({ list: parsed.list, interface: parsed.interface, id: created[".id"] }, "Interface list member added");
+        return {
+          content: `Added "${parsed.interface}" to list "${parsed.list}".`,
+          structuredContent: { action: "created", list: parsed.list, interface: parsed.interface, id: created[".id"] }
+        };
       }
-      if (Object.keys(updates).length === 0) {
+      if (!existing) {
         return {
-          content: `OpenVPN server on ${context.routerId} already matches the requested configuration. No changes made.`,
-          structuredContent: { action: "no_change", server }
+          content: `Interface "${parsed.interface}" is not a member of list "${parsed.list}". Nothing to remove.`,
+          structuredContent: { action: "not_found", list: parsed.list, interface: parsed.interface }
         };
       }
       if (parsed.dryRun) {
         return {
-          content: `Dry run: Would update OpenVPN server on ${context.routerId}.`,
-          structuredContent: { action: "dry_run", diff }
+          content: `Dry run: Would remove "${parsed.interface}" from list "${parsed.list}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "interface", before: parsed.interface, after: null }]
+          }
         };
       }
-      await context.routerClient.update(OVPN_SERVER_PATH, serverId, updates);
-      log37.info({ routerId: context.routerId }, "OpenVPN server configuration updated");
+      await context.routerClient.remove("interface/list/member", existing[".id"]);
+      log45.info({ list: parsed.list, interface: parsed.interface }, "Interface list member removed");
       return {
-        content: `Updated OpenVPN server configuration on ${context.routerId}.`,
-        structuredContent: { action: "updated", diff }
+        content: `Removed "${parsed.interface}" from list "${parsed.list}".`,
+        structuredContent: {
+          action: "removed",
+          list: parsed.list,
+          interface: parsed.interface,
+          id: existing[".id"]
+        }
       };
     } catch (err) {
       if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_server" });
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_interface_list_member" });
     }
   }
 };
-var ovpnTools = [
-  listOvpnClientsTool,
-  manageOvpnClientTool,
-  getOvpnServerTool,
-  manageOvpnServerTool
+var interfaceListTools = [
+  listInterfaceListsTool,
+  manageInterfaceListTool,
+  manageInterfaceListMemberTool
 ];
 
 // src/domain/tools/fleet-tools.ts
-import { z as z37 } from "zod";
+import { z as z45 } from "zod";
 
 // src/middleware/authz.ts
 function matchesPattern(name, pattern) {
@@ -8644,7 +10820,7 @@ var SshClient = class {
 // src/adapter/ftp-client.ts
 import { Client as Client2 } from "basic-ftp";
 import { Readable } from "stream";
-var log38 = createLogger("ftp-client");
+var log46 = createLogger("ftp-client");
 var FtpClient = class {
   #host;
   #port;
@@ -8657,7 +10833,7 @@ var FtpClient = class {
     this.#password = password;
   }
   async upload(remoteName, content) {
-    log38.info({ host: this.#host, remoteName }, "Uploading file via FTP");
+    log46.info({ host: this.#host, remoteName }, "Uploading file via FTP");
     const client = new Client2();
     try {
       await client.access({
@@ -8667,7 +10843,7 @@ var FtpClient = class {
         password: this.#password
       });
       await client.uploadFrom(Readable.from(Buffer.from(content, "utf-8")), remoteName);
-      log38.info({ host: this.#host, remoteName }, "FTP upload complete");
+      log46.info({ host: this.#host, remoteName }, "FTP upload complete");
     } finally {
       client.close();
     }
@@ -8775,17 +10951,17 @@ function checkFleetConfirmation(args, secret) {
 }
 
 // src/domain/tools/fleet-tools.ts
-var log39 = createLogger("fleet-tools");
-var checkHealthInputSchema = z37.object({
-  routerId: z37.string().describe("Target router to health-check")
+var log47 = createLogger("fleet-tools");
+var checkHealthInputSchema = z45.object({
+  routerId: z45.string().describe("Target router to health-check")
 }).strict();
-var bulkExecuteInputSchema = z37.object({
-  toolName: z37.string().describe("Name of the tool to fan out (must be a single-router tool)"),
-  routerIds: z37.array(z37.string()).optional().describe("Explicit list of router IDs to target"),
-  tags: z37.array(z37.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
-  params: z37.record(z37.string(), z37.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
-  concurrency: z37.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
-  confirmationToken: z37.string().optional().describe(
+var bulkExecuteInputSchema = z45.object({
+  toolName: z45.string().describe("Name of the tool to fan out (must be a single-router tool)"),
+  routerIds: z45.array(z45.string()).optional().describe("Explicit list of router IDs to target"),
+  tags: z45.array(z45.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
+  params: z45.record(z45.string(), z45.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
+  concurrency: z45.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
+  confirmationToken: z45.string().optional().describe(
     "Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool."
   )
 }).strict();
@@ -8804,7 +10980,7 @@ function createFleetTools(baseTools2) {
     },
     async handler(params, context) {
       checkHealthInputSchema.parse(params);
-      log39.info({ routerId: context.routerId }, "Checking router health");
+      log47.info({ routerId: context.routerId }, "Checking router health");
       const startMs = Date.now();
       try {
         const resources = await context.routerClient.get("system/resource");
@@ -8866,7 +11042,7 @@ function createFleetTools(baseTools2) {
           }
         });
       }
-      log39.info(
+      log47.info(
         { toolName: parsed.toolName, concurrency: parsed.concurrency },
         "bulk_execute invoked"
       );
@@ -8913,7 +11089,7 @@ function createFleetTools(baseTools2) {
           try {
             resolved.push(context.routerRegistry.getRouter(id));
           } catch {
-            log39.warn({ routerId: id }, "bulk_execute: router not found");
+            log47.warn({ routerId: id }, "bulk_execute: router not found");
             preErrors.push({
               routerId: id,
               status: "error",
@@ -9084,6 +11260,7 @@ var baseTools = [
   ...ipsecTools,
   ...certificateTools,
   ...userTools,
+  ...userGroupTools,
   ...dhcpServerTools,
   ...ipPoolTools,
   ...queueTools,
@@ -9093,7 +11270,14 @@ var baseTools = [
   ...dhcpClientTools,
   ...ipServiceTools,
   ...pppoeTools,
-  ...ovpnTools
+  ...ovpnTools,
+  ...pppTools,
+  ...upgradeTools,
+  ...backupTools,
+  ...logTools,
+  ...networkTestTools,
+  ...containerConfigTools,
+  ...interfaceListTools
 ];
 var allTools = [
   ...baseTools,
@@ -9492,7 +11676,7 @@ var CircuitBreaker = class {
 };
 
 // src/mcp/tool-executor.ts
-var log40 = createLogger("tool-executor");
+var log48 = createLogger("tool-executor");
 async function executeToolCall(tool, args, deps) {
   const { registry, pool, circuitBreakers, config, identityRegistry } = deps;
   const correlationId = nanoid4();
@@ -9588,9 +11772,9 @@ async function executeToolCall(tool, args, deps) {
           try {
             const meta = await takeSnapshot(toolContext.routerClient, routerId, path, config.snapshotDir);
             snapshotIds.push(meta.id);
-            log40.debug({ snapshotId: meta.id, path }, "Snapshot taken");
+            log48.debug({ snapshotId: meta.id, path }, "Snapshot taken");
           } catch (err) {
-            log40.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
+            log48.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
           }
         }
       }
@@ -9632,7 +11816,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log40.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
+      log48.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
       recordToolCall(tool.name, "success");
       return formatToolResult(result);
     } catch (err) {
@@ -9641,7 +11825,7 @@ async function executeToolCall(tool, args, deps) {
         const failedRouterId = args.routerId;
         if (failedRouterId) {
           pool.removeClient(failedRouterId);
-          log40.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
+          log48.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
         }
       }
       if (journalId) {
@@ -9671,7 +11855,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log40.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
+      log48.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
       recordToolCall(tool.name, "error");
       return formatError(error);
     }
@@ -9679,12 +11863,12 @@ async function executeToolCall(tool, args, deps) {
 }
 
 // src/mcp/tool-registry.ts
-var log41 = createLogger("tool-registry");
+var log49 = createLogger("tool-registry");
 function registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry) {
   const deps = { registry, pool, circuitBreakers, config, identityRegistry };
   for (const tool of allTools) {
     const registrationSchema = tool.annotations.destructiveHint ? tool.inputSchema.extend({
-      confirmationToken: z38.string().optional().describe(
+      confirmationToken: z46.string().optional().describe(
         "Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action."
       )
     }) : tool.inputSchema;
@@ -9698,56 +11882,56 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
       },
       (args) => executeToolCall(tool, args, deps)
     );
-    log41.debug({ tool: tool.name }, "Registered tool");
+    log49.debug({ tool: tool.name }, "Registered tool");
   }
-  log41.info({ count: allTools.length }, "All tools registered");
+  log49.info({ count: allTools.length }, "All tools registered");
 }
 
 // src/config/router-registry.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
 import { parse } from "yaml";
-import { z as z39 } from "zod";
-var log42 = createLogger("router-registry");
-var RouterConfigSchema = z39.object({
-  host: z39.string().min(1, "host is required"),
-  port: z39.number().int().min(1).max(65535),
-  tls: z39.object({
-    enabled: z39.boolean(),
-    rejectUnauthorized: z39.boolean(),
-    ca: z39.string().optional(),
-    fingerprint: z39.string().optional()
+import { z as z47 } from "zod";
+var log50 = createLogger("router-registry");
+var RouterConfigSchema = z47.object({
+  host: z47.string().min(1, "host is required"),
+  port: z47.number().int().min(1).max(65535),
+  tls: z47.object({
+    enabled: z47.boolean(),
+    rejectUnauthorized: z47.boolean(),
+    ca: z47.string().optional(),
+    fingerprint: z47.string().optional()
   }).strict(),
-  credentials: z39.object({
-    source: z39.enum(["env", "vault"]),
-    envPrefix: z39.string().optional(),
-    vaultPath: z39.string().optional()
+  credentials: z47.object({
+    source: z47.enum(["env", "vault"]),
+    envPrefix: z47.string().optional(),
+    vaultPath: z47.string().optional()
   }).strict(),
-  tags: z39.array(z39.string()).default([]),
-  rosVersion: z39.string().min(1),
-  sshPort: z39.number().int().min(1).max(65535).optional(),
-  sshFingerprint: z39.string().optional(),
-  cmdAllow: z39.array(z39.string()).optional(),
-  cmdDeny: z39.array(z39.string()).optional(),
-  maintenanceWindows: z39.array(
-    z39.object({
-      days: z39.array(
-        z39.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
+  tags: z47.array(z47.string()).default([]),
+  rosVersion: z47.string().min(1),
+  sshPort: z47.number().int().min(1).max(65535).optional(),
+  sshFingerprint: z47.string().optional(),
+  cmdAllow: z47.array(z47.string()).optional(),
+  cmdDeny: z47.array(z47.string()).optional(),
+  maintenanceWindows: z47.array(
+    z47.object({
+      days: z47.array(
+        z47.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
       ),
-      startTime: z39.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
-      endTime: z39.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
-      timezone: z39.string().min(1)
+      startTime: z47.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
+      endTime: z47.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
+      timezone: z47.string().min(1)
     }).strict()
   ).optional()
 }).strict();
-var ConfigFileSchema = z39.object({
-  routers: z39.record(z39.string(), RouterConfigSchema)
+var ConfigFileSchema = z47.object({
+  routers: z47.record(z47.string(), RouterConfigSchema)
 }).strict();
 var RouterRegistry = class {
   routers;
   constructor(configPath) {
     this.routers = /* @__PURE__ */ new Map();
     if (!existsSync(configPath)) {
-      log42.warn({ configPath }, "Router config file not found; starting with empty registry");
+      log50.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
     const raw = readFileSync2(configPath, "utf-8");
@@ -9761,14 +11945,14 @@ ${issues}`);
     for (const [id, config] of Object.entries(result.data.routers)) {
       const routerConfig = { ...config, id };
       if (routerConfig.tls.enabled && !routerConfig.tls.rejectUnauthorized) {
-        log42.warn(
+        log50.warn(
           { routerId: id },
           "TLS certificate validation is DISABLED (rejectUnauthorized=false). Set tls.fingerprint to pin the server certificate instead."
         );
       }
       this.routers.set(id, routerConfig);
     }
-    log42.info({ count: this.routers.size }, "Loaded routers from config");
+    log50.info({ count: this.routers.size }, "Loaded routers from config");
   }
   getRouter(id) {
     const router = this.routers.get(id);
@@ -10053,7 +12237,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.3.0";
+var VERSION = "1.5.0";
 
 // src/mcp/server.ts
 function createServerFactory(config, identityRegistry) {
@@ -10083,7 +12267,7 @@ import { randomUUID } from "crypto";
 import { createServer } from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-var log43 = createLogger("transport-http");
+var log51 = createLogger("transport-http");
 var BodyTooLargeError = class extends Error {
   constructor() {
     super("Request body exceeds maximum allowed size");
@@ -10175,7 +12359,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
       return;
     }
     if (!checkRateLimit(ip)) {
-      log43.warn({ ip }, "Rate limit exceeded");
+      log51.warn({ ip }, "Rate limit exceeded");
       res.writeHead(429, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Too many requests. Retry after 60 seconds." }));
       return;
@@ -10216,7 +12400,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
         }
         return;
       }
-      log43.error({ err }, "HTTP transport error");
+      log51.error({ err }, "HTTP transport error");
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Internal server error" }));
@@ -10226,7 +12410,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
   httpServer.on("close", () => clearInterval(sweepTimer));
   await new Promise((resolve, reject) => {
     httpServer.listen(port, bindHost, () => {
-      log43.info(
+      log51.info(
         { port, bindHost },
         "HTTP transport listening (POST /mcp for Streamable HTTP, GET /sse for legacy SSE)"
       );
@@ -10250,13 +12434,13 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (id) => {
           streamableSessions.set(id, transport2);
-          log43.info({ sessionId: id }, "Streamable HTTP session created");
+          log51.info({ sessionId: id }, "Streamable HTTP session created");
         }
       });
       transport2.onclose = () => {
         if (transport2.sessionId) {
           streamableSessions.delete(transport2.sessionId);
-          log43.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
+          log51.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
         }
       };
       await makeServer().connect(transport2);
@@ -10273,7 +12457,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
     sseTransport.onclose = () => {
       sseTransports.delete(sseTransport.sessionId);
     };
-    log43.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
+    log51.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
     await sseTransport.start();
     return;
   }
@@ -10294,23 +12478,23 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 // src/config/identity-registry.ts
 import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
 import { parse as parse2 } from "yaml";
-import { z as z40 } from "zod";
+import { z as z48 } from "zod";
 import bcrypt from "bcryptjs";
-var log44 = createLogger("identity-registry");
-var IdentityConfigSchema = z40.object({
-  token: z40.string().min(1, "token hash is required"),
-  role: z40.enum(["readonly", "operator", "admin", "superadmin"]),
-  allowedRouters: z40.array(z40.string()).default([]),
-  allowedToolPatterns: z40.array(z40.string()).default([])
+var log52 = createLogger("identity-registry");
+var IdentityConfigSchema = z48.object({
+  token: z48.string().min(1, "token hash is required"),
+  role: z48.enum(["readonly", "operator", "admin", "superadmin"]),
+  allowedRouters: z48.array(z48.string()).default([]),
+  allowedToolPatterns: z48.array(z48.string()).default([])
 }).strict();
-var ConfigFileSchema2 = z40.object({
-  identities: z40.record(z40.string(), IdentityConfigSchema)
+var ConfigFileSchema2 = z48.object({
+  identities: z48.record(z48.string(), IdentityConfigSchema)
 }).strict();
 var IdentityRegistry = class {
   identities = [];
   constructor(configPath) {
     if (!existsSync2(configPath)) {
-      log44.warn(
+      log52.warn(
         { configPath },
         "Identity config file not found; starting with empty registry (stdio callers do not require it)"
       );
@@ -10333,7 +12517,7 @@ ${issues}`);
         allowedToolPatterns: config.allowedToolPatterns
       });
     }
-    log44.info({ count: this.identities.length }, "Loaded identities from config");
+    log52.info({ count: this.identities.length }, "Loaded identities from config");
   }
   getIdentities() {
     return this.identities.map(({ id, role, allowedRouters, allowedToolPatterns }) => ({
@@ -10362,7 +12546,7 @@ ${issues}`);
 // src/domain/snapshot/retention.ts
 import { readdir, stat, unlink } from "fs/promises";
 import { join as join3 } from "path";
-var log45 = createLogger("snapshot-retention");
+var log53 = createLogger("snapshot-retention");
 async function pruneSnapshots(snapshotDir, maxAgeDays) {
   const cutoffMs = Date.now() - maxAgeDays * 864e5;
   let removed = 0;
@@ -10389,21 +12573,21 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
           removed++;
         }
       } catch (err) {
-        log45.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
+        log53.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
       }
     }
   }
   if (removed > 0) {
-    log45.info({ removed, maxAgeDays }, "Pruned expired snapshots");
+    log53.info({ removed, maxAgeDays }, "Pruned expired snapshots");
   }
   return removed;
 }
 
 // src/cli/serve.ts
-var log46 = createLogger("main");
+var log54 = createLogger("main");
 async function runServe() {
   const config = loadAppConfig();
-  log46.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
+  log54.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
@@ -10411,7 +12595,7 @@ async function runServe() {
       (i) => i.role === "readonly" || i.role === "operator"
     );
     if (hasLimitedRoles && !config.confirmationSecret) {
-      log46.error(
+      log54.error(
         "MIKROMCP_CONFIRMATION_SECRET is required in HTTP mode when identities with role readonly or operator are configured"
       );
       process.exit(1);
@@ -10421,7 +12605,7 @@ async function runServe() {
   if (config.transport === "stdio") {
     const stdioIdentity = getStdioIdentity(config.stdioIdentity, identityRegistry);
     await withIdentity(stdioIdentity, () => connectStdio(makeServer()));
-    log46.info("MikroMCP server running via stdio");
+    log54.info("MikroMCP server running via stdio");
   } else if (config.transport === "http") {
     await connectHttp(
       makeServer,
@@ -10433,13 +12617,13 @@ async function runServe() {
       },
       identityRegistry
     );
-    log46.info(
+    log54.info(
       { port: config.port, bindHost: config.bindHost },
       "MikroMCP server running via HTTP/SSE"
     );
   }
   const shutdown = () => {
-    log46.info("Shutting down MikroMCP server");
+    log54.info("Shutting down MikroMCP server");
     pool.closeAll();
     process.exit(0);
   };
@@ -10452,7 +12636,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.3.0";
+var localVersion = "1.5.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -11104,7 +13288,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.3.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.5.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);