mikromcp 1.5.0 → 1.6.0

package/dist/main.js

@@ -24,6 +24,7 @@ function loadAppConfig() {
     bindHost: env.MIKROMCP_BIND_HOST ?? "127.0.0.1",
     logLevel: env.MIKROMCP_LOG_LEVEL ?? "info",
     configPath: env.MIKROMCP_CONFIG_PATH ?? join(mikromcpDir(), "routers.yaml"),
+    defaultRouter: env.MIKROMCP_DEFAULT_ROUTER || void 0,
     dataDir,
     snapshotDir: `${dataDir}/snapshots`,
     journalPath: `${dataDir}/write-journal.ndjson`,
@@ -60,10 +61,17 @@ function loadAppConfig() {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/tool-registry.ts
-import { z as z46 } from "zod";
+import { z as z47 } from "zod";
 
 // src/domain/tools/system-tools.ts
+import { z as z2 } from "zod";
+
+// src/domain/tools/schema-fields.ts
 import { z } from "zod";
+var routerId = z.string().optional().describe("Router ID; omit to use the default router.");
+var dryRun = z.boolean().default(false).describe("Preview changes without applying.");
+var offset = z.number().int().min(0).default(0).describe("Pagination offset.");
+var limit = z.number().int().min(1).max(500).default(100).describe("Max results to return.");
 
 // src/domain/errors/error-enricher.ts
 import { ZodError } from "zod";
@@ -274,6 +282,11 @@ function enrichError(error, context) {
   });
 }
 
+// src/domain/tools/tool-definition.ts
+function toolError(err, context, tool) {
+  return enrichError(err, { routerId: context.routerId, tool });
+}
+
 // src/observability/logger.ts
 import pino from "pino";
 var isDevelopment = process.env.NODE_ENV === "development";
@@ -320,9 +333,9 @@ var SECTION_PATHS = {
   health: "system/health",
   clock: "system/clock"
 };
-var inputSchema = z.object({
-  routerId: z.string().describe("Target router identifier from the router registry"),
-  sections: z.array(z.enum(SECTION_VALUES)).default(["all"]).describe("Which system information sections to include")
+var inputSchema = z2.object({
+  routerId,
+  sections: z2.array(z2.enum(SECTION_VALUES)).default(["all"]).describe("Which system information sections to include")
 }).strict();
 async function fetchSection(context, section) {
   const path = SECTION_PATHS[section];
@@ -419,23 +432,39 @@ var getSystemStatusTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_system_status" });
+      throw toolError(err, context, "get_system_status");
     }
   }
 };
 var systemTools = [getSystemStatusTool];
 
 // src/domain/tools/interface-tools.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+
+// src/domain/tools/pagination.ts
+function paginate(items, offset2, limit2) {
+  const total = items.length;
+  return {
+    items: items.slice(offset2, offset2 + limit2),
+    total,
+    hasMore: offset2 + limit2 < total
+  };
+}
+function listSummary(label, routerId2, shown, total, offset2) {
+  const range = total === 0 ? "none" : `${offset2 + 1}-${offset2 + shown} of ${total}`;
+  return `${label} on ${routerId2}: ${range}. Full records in structuredContent.`;
+}
+
+// src/domain/tools/interface-tools.ts
 var log2 = createLogger("interface-tools");
-var listInputSchema = z2.object({
-  routerId: z2.string().describe("Target router identifier from the router registry"),
-  type: z2.enum(["ether", "vlan", "bridge", "bonding", "wireguard", "gre", "all"]).default("all").describe("Filter by interface type"),
-  status: z2.enum(["up", "down", "all"]).default("all").describe("Filter by running status"),
-  macAddress: z2.string().optional().describe("Filter by MAC address (case-insensitive exact match on mac-address field)"),
-  includeCounters: z2.boolean().default(false).describe("Include traffic counters (tx-byte, rx-byte, etc.)"),
-  limit: z2.number().int().min(1).max(500).default(100).describe("Maximum number of interfaces to return"),
-  offset: z2.number().int().min(0).default(0).describe("Offset for pagination")
+var listInputSchema = z3.object({
+  routerId,
+  type: z3.enum(["ether", "vlan", "bridge", "bonding", "wireguard", "gre", "all"]).default("all").describe("Filter by interface type"),
+  status: z3.enum(["up", "down", "all"]).default("all").describe("Filter by running status"),
+  macAddress: z3.string().optional().describe("Filter by MAC address (case-insensitive exact match on mac-address field)"),
+  includeCounters: z3.boolean().default(false).describe("Include traffic counters (tx-byte, rx-byte, etc.)"),
+  limit,
+  offset
 }).strict();
 var COUNTER_PROPS = [
   "tx-byte",
@@ -493,8 +522,7 @@ var listInterfacesTool = {
           return true;
         });
       }
-      const total = interfaces.length;
-      const paginated = interfaces.slice(parsed.offset, parsed.offset + parsed.limit);
+      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
       const results2 = paginated.map((iface) => {
         const rec = iface;
         const isRunning2 = rec.running === true || rec.running === "true";
@@ -507,19 +535,8 @@ var listInterfacesTool = {
         }
         return enriched;
       });
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `Interfaces on ${context.routerId}: ${total} total, showing ${results2.length} (offset ${parsed.offset})`
-      ];
-      for (const iface of results2) {
-        const rec = iface;
-        const name = rec.name ?? rec[".id"] ?? "unknown";
-        const type = rec.type ?? parsed.type;
-        const status = String(rec.status).toUpperCase();
-        lines.push(`  ${name} [${type}] ${status}`);
-      }
       return {
-        content: lines.join("\n"),
+        content: listSummary("Interfaces", context.routerId, results2.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           interfaces: results2,
@@ -530,17 +547,17 @@ var listInterfacesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_interfaces" });
+      throw toolError(err, context, "list_interfaces");
     }
   }
 };
 var interfaceTools = [listInterfacesTool];
 
 // src/domain/tools/ip-tools.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/domain/tools/cidr.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function validateCidr(value) {
   const withPrefix = value.includes("/") ? value : `${value}/32`;
   const slashIdx = withPrefix.lastIndexOf("/");
@@ -562,28 +579,28 @@ function validateCidr(value) {
   }
   return withPrefix;
 }
-var cidrSchema = z3.string().transform((v, ctx) => {
+var cidrSchema = z4.string().transform((v, ctx) => {
   try {
     return validateCidr(v);
   } catch (e) {
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, message: e.message });
-    return z3.NEVER;
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, message: e.message });
+    return z4.NEVER;
   }
 });
 
 // src/domain/tools/ip-tools.ts
 var log3 = createLogger("ip-tools");
-var inputSchema2 = z4.object({
-  routerId: z4.string().describe("Target router identifier from the router registry"),
-  action: z4.enum(["add", "update", "remove"]).describe("Action to perform: add, update, or remove an IP address"),
+var inputSchema2 = z5.object({
+  routerId,
+  action: z5.enum(["add", "update", "remove"]).describe("Action to perform: add, update, or remove an IP address"),
   address: cidrSchema.describe(
     "IP address with optional prefix length in CIDR notation (e.g., 192.168.1.1/24). Defaults to /32 if prefix is omitted."
   ),
-  interface: z4.string().describe("Interface to assign the IP address to"),
-  network: z4.string().optional().describe("Network address (auto-calculated from address if omitted)"),
-  comment: z4.string().max(255).optional().describe("Optional comment for the IP address entry"),
-  disabled: z4.boolean().default(false).describe("Whether the IP address should be disabled"),
-  dryRun: z4.boolean().default(false).describe("If true, validate and return planned changes without applying")
+  interface: z5.string().describe("Interface to assign the IP address to"),
+  network: z5.string().optional().describe("Network address (auto-calculated from address if omitted)"),
+  comment: z5.string().max(255).optional().describe("Optional comment for the IP address entry"),
+  disabled: z5.boolean().default(false).describe("Whether the IP address should be disabled"),
+  dryRun: z5.boolean().default(false).describe("If true, validate and return planned changes without applying")
 }).strict();
 function sanitizeComment(comment) {
   if (comment === void 0) return void 0;
@@ -783,24 +800,23 @@ var manageIpAddressTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ip_address" });
+      throw toolError(err, context, "manage_ip_address");
     }
   }
 };
 var ipTools = [manageIpAddressTool];
 
 // src/domain/tools/dhcp-tools.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var log4 = createLogger("dhcp-tools");
-var listDhcpLeasesInputSchema = z5.object({
-  routerId: z5.string().describe("Target router identifier from the router registry"),
-  server: z5.string().optional().describe("Filter by DHCP server name"),
-  status: z5.enum(["bound", "waiting", "offered", "blocked", "all"]).default("all").describe("Filter by lease status"),
-  macAddress: z5.string().optional().describe("Filter by MAC address (exact match, case-insensitive)"),
-  leaseType: z5.enum(["dynamic", "static", "all"]).default("all").describe("Filter by lease type (dynamic or static)"),
-  limit: z5.number().int().min(1).max(500).default(100).describe("Maximum number of leases to return"),
-  offset: z5.number().int().min(0).default(0).describe("Offset for pagination")
+var listDhcpLeasesInputSchema = z6.object({
+  routerId,
+  server: z6.string().optional().describe("Filter by DHCP server name"),
+  status: z6.enum(["bound", "waiting", "offered", "blocked", "all"]).default("all").describe("Filter by lease status"),
+  macAddress: z6.string().optional().describe("Filter by MAC address (exact match, case-insensitive)"),
+  leaseType: z6.enum(["dynamic", "static", "all"]).default("all").describe("Filter by lease type (dynamic or static)"),
+  limit,
+  offset
 }).strict();
 var listDhcpLeasesTool = {
   name: "list_dhcp_leases",
@@ -857,23 +873,9 @@ var listDhcpLeasesTool = {
           return !isDynamic;
         });
       }
-      const total = leases.length;
-      const paginated = leases.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `DHCP leases on ${context.routerId}: ${total} total, showing ${paginated.length} (offset ${parsed.offset})`
-      ];
-      for (const lease of paginated) {
-        const rec = lease;
-        const address = rec.address ?? rec["active-address"] ?? "unknown";
-        const macAddress = rec["mac-address"] ?? rec["active-mac-address"] ?? "unknown";
-        const hostname = rec["host-name"];
-        const hostnameStr = hostname && hostname !== "" ? ` (${hostname})` : "";
-        const status = rec.status ?? "unknown";
-        lines.push(`  ${address}  ${macAddress}${hostnameStr}  [${status}]`);
-      }
+      const { items: paginated, total, hasMore } = paginate(leases, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("DHCP leases", context.routerId, paginated.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           leases: paginated,
@@ -884,17 +886,17 @@ var listDhcpLeasesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_leases" });
+      throw toolError(err, context, "list_dhcp_leases");
     }
   }
 };
-var manageDhcpLeaseInputSchema = z5.object({
-  routerId: z5.string().describe("Target router identifier from the router registry"),
-  action: z5.enum(["make-static", "remove"]).describe(
+var manageDhcpLeaseInputSchema = z6.object({
+  routerId,
+  action: z6.enum(["make-static", "remove"]).describe(
     "Action to perform: make-static converts a dynamic lease to static; remove deletes the lease"
   ),
-  macAddress: z5.string().describe("MAC address of the lease \u2014 idempotency key (case-insensitive)"),
-  dryRun: z5.boolean().default(false).describe("Preview changes without applying")
+  macAddress: z6.string().describe("MAC address of the lease \u2014 idempotency key (case-insensitive)"),
+  dryRun
 }).strict();
 var manageDhcpLeaseTool = {
   name: "manage_dhcp_lease",
@@ -986,22 +988,21 @@ var manageDhcpLeaseTool = {
         structuredContent: { action: "removed", macAddress: upperMac, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_lease" });
+      throw toolError(err, context, "manage_dhcp_lease");
     }
   }
 };
 var dhcpTools = [listDhcpLeasesTool, manageDhcpLeaseTool];
 
 // src/domain/tools/route-tools.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var log5 = createLogger("route-tools");
-var listRoutesInputSchema = z6.object({
-  routerId: z6.string().describe("Target router identifier from the router registry"),
-  activeOnly: z6.boolean().default(false).describe("Return only active routes"),
-  staticOnly: z6.boolean().default(false).describe("Return only non-dynamic routes"),
-  limit: z6.number().int().min(1).max(500).default(100).describe("Maximum number of routes to return"),
-  offset: z6.number().int().min(0).default(0).describe("Offset for pagination")
+var listRoutesInputSchema = z7.object({
+  routerId,
+  activeOnly: z7.boolean().default(false).describe("Return only active routes"),
+  staticOnly: z7.boolean().default(false).describe("Return only non-dynamic routes"),
+  limit,
+  offset
 }).strict();
 var listRoutesTool = {
   name: "list_routes",
@@ -1041,33 +1042,9 @@ var listRoutesTool = {
           return rec.dynamic !== true && rec.dynamic !== "true";
         });
       }
-      const total = routes.length;
-      const paginated = routes.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `Routes on ${context.routerId}: ${total} total, showing ${paginated.length} (offset ${parsed.offset})`
-      ];
-      for (const route of paginated) {
-        const rec = route;
-        const dstAddress = rec["dst-address"] ?? "unknown";
-        const gateway = rec.gateway ?? rec["immediate-gw"] ?? "unknown";
-        const distance = rec.distance;
-        const active = rec.active === true || rec.active === "true";
-        const dynamic = rec.dynamic === true || rec.dynamic === "true";
-        let line = `  ${dstAddress} via ${gateway}`;
-        if (distance) {
-          line += ` [${distance}]`;
-        }
-        if (active) {
-          line += " ACTIVE";
-        }
-        if (dynamic) {
-          line += " DYNAMIC";
-        }
-        lines.push(line);
-      }
+      const { items: paginated, total, hasMore } = paginate(routes, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("Routes", context.routerId, paginated.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           routes: paginated,
@@ -1078,22 +1055,22 @@ var listRoutesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_routes" });
+      throw toolError(err, context, "list_routes");
     }
   }
 };
-var manageRouteInputSchema = z6.object({
-  routerId: z6.string().describe("Target router identifier from the router registry"),
-  action: z6.enum(["add", "remove"]).describe("Action to perform: add or remove a route"),
+var manageRouteInputSchema = z7.object({
+  routerId,
+  action: z7.enum(["add", "remove"]).describe("Action to perform: add or remove a route"),
   dstAddress: cidrSchema.describe(
     "Destination address in CIDR notation or plain IP (auto-converted to /32), e.g. 10.0.0.0/8 or 10.77.0.4"
   ),
-  gateway: z6.string().describe("Gateway IP address"),
-  distance: z6.number().int().min(1).max(255).default(1).describe("Route distance/metric (1-255)"),
-  comment: z6.string().max(255).optional().describe("Optional comment for the route"),
-  routingTable: z6.string().optional().describe("Routing table name (default: main). Use for policy routing with separate tables."),
-  disabled: z6.boolean().default(false).describe("Whether the route should be disabled"),
-  dryRun: z6.boolean().default(false).describe("If true, validate and return planned changes without applying")
+  gateway: z7.string().describe("Gateway IP address"),
+  distance: z7.number().int().min(1).max(255).default(1).describe("Route distance/metric (1-255)"),
+  comment: z7.string().max(255).optional().describe("Optional comment for the route"),
+  routingTable: z7.string().optional().describe("Routing table name (default: main). Use for policy routing with separate tables."),
+  disabled: z7.boolean().default(false).describe("Whether the route should be disabled"),
+  dryRun: z7.boolean().default(false).describe("If true, validate and return planned changes without applying")
 }).strict();
 function sanitizeComment2(comment) {
   if (comment === void 0) return void 0;
@@ -1251,15 +1228,14 @@ var manageRouteTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_route" });
+      throw toolError(err, context, "manage_route");
     }
   }
 };
 var routeTools = [listRoutesTool, manageRouteTool];
 
 // src/domain/tools/firewall-tools.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var log6 = createLogger("firewall-tools");
 function tableToPath(table) {
   return table === "filter" ? "ip/firewall/filter" : "ip/firewall/nat";
@@ -1274,13 +1250,13 @@ async function findRuleByComment(context, path, comment) {
   });
   return results2.length > 0 ? results2[0] : void 0;
 }
-var listFirewallRulesInputSchema = z7.object({
-  routerId: z7.string().describe("Target router identifier from the router registry"),
-  table: z7.enum(["filter", "nat"]).default("filter").describe("Firewall table to query: filter or nat"),
-  chain: z7.string().optional().describe("Filter rules by chain name (e.g. forward, input, srcnat)"),
-  disabled: z7.enum(["true", "false", "all"]).default("all").describe("Filter by disabled state: true, false, or all"),
-  limit: z7.number().int().min(1).max(500).default(100).describe("Maximum number of rules to return"),
-  offset: z7.number().int().min(0).default(0).describe("Offset for pagination")
+var listFirewallRulesInputSchema = z8.object({
+  routerId,
+  table: z8.enum(["filter", "nat"]).default("filter").describe("Firewall table to query: filter or nat"),
+  chain: z8.string().optional().describe("Filter rules by chain name (e.g. forward, input, srcnat)"),
+  disabled: z8.enum(["true", "false", "all"]).default("all").describe("Filter by disabled state: true, false, or all"),
+  limit,
+  offset
 }).strict();
 var listFirewallRulesTool = {
   name: "list_firewall_rules",
@@ -1323,38 +1299,15 @@ var listFirewallRulesTool = {
           return isDisabled === (parsed.disabled === "true");
         });
       }
-      const total = rules.length;
-      const paginated = rules.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `Firewall ${parsed.table} rules on ${context.routerId}: ${total} total, showing ${paginated.length} (offset ${parsed.offset})`
-      ];
-      for (const rule of paginated) {
-        const rec = rule;
-        const chain = rec.chain ?? "?";
-        const action = rec.action ?? "?";
-        const isDisabled = rec.disabled === true || rec.disabled === "true";
-        let line = `  [${chain}]`;
-        if (rec.protocol !== void 0) {
-          line += ` ${rec.protocol}`;
-        }
-        if (rec["src-address"] !== void 0) {
-          line += ` src:${rec["src-address"]}`;
-        }
-        if (rec["dst-address"] !== void 0) {
-          line += ` dst:${rec["dst-address"]}`;
-        }
-        line += ` => ${action}`;
-        if (isDisabled) {
-          line += " [disabled]";
-        }
-        if (rec.comment !== void 0) {
-          line += ` // ${rec.comment}`;
-        }
-        lines.push(line);
-      }
+      const { items: paginated, total, hasMore } = paginate(rules, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary(
+          `Firewall ${parsed.table} rules`,
+          context.routerId,
+          paginated.length,
+          total,
+          parsed.offset
+        ),
         structuredContent: {
           routerId: context.routerId,
           table: parsed.table,
@@ -1366,28 +1319,27 @@ var listFirewallRulesTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_firewall_rules" });
-    }
-  }
-};
-var manageFirewallRuleInputSchema = z7.object({
-  routerId: z7.string().describe("Target router identifier from the router registry"),
-  table: z7.enum(["filter", "nat"]).default("filter").describe("Firewall table to manage: filter or nat"),
-  action: z7.enum(["add", "remove", "disable", "enable"]).describe("Action to perform: add, remove, disable, or enable a firewall rule"),
-  chain: z7.string().describe("Firewall chain (e.g. forward, input, output, srcnat, dstnat)"),
-  ruleAction: z7.string().describe("RouterOS rule action (e.g. accept, drop, reject, masquerade)"),
-  srcAddress: z7.string().optional().describe("Source address or network"),
-  dstAddress: z7.string().optional().describe("Destination address or network"),
-  protocol: z7.enum(["tcp", "udp", "icmp", "gre", "ospf", "all"]).optional().describe("Protocol to match"),
-  srcPort: z7.string().optional().describe("Source port or range"),
-  dstPort: z7.string().optional().describe("Destination port or range"),
-  inInterface: z7.string().optional().describe("Incoming interface"),
-  outInterface: z7.string().optional().describe("Outgoing interface"),
-  comment: z7.string().max(255).optional().describe("Comment to identify the rule (used as idempotency key)"),
-  disabled: z7.boolean().default(false).describe("Whether the rule should be disabled"),
-  placeBefore: z7.string().optional().describe("Place the new rule before this rule ID"),
-  dryRun: z7.boolean().default(false).describe("If true, validate and return planned changes without applying")
+      throw toolError(err, context, "list_firewall_rules");
+    }
+  }
+};
+var manageFirewallRuleInputSchema = z8.object({
+  routerId,
+  table: z8.enum(["filter", "nat"]).default("filter").describe("Firewall table to manage: filter or nat"),
+  action: z8.enum(["add", "remove", "disable", "enable"]).describe("Action to perform: add, remove, disable, or enable a firewall rule"),
+  chain: z8.string().describe("Firewall chain (e.g. forward, input, output, srcnat, dstnat)"),
+  ruleAction: z8.string().describe("RouterOS rule action (e.g. accept, drop, reject, masquerade)"),
+  srcAddress: z8.string().optional().describe("Source address or network"),
+  dstAddress: z8.string().optional().describe("Destination address or network"),
+  protocol: z8.enum(["tcp", "udp", "icmp", "gre", "ospf", "all"]).optional().describe("Protocol to match"),
+  srcPort: z8.string().optional().describe("Source port or range"),
+  dstPort: z8.string().optional().describe("Destination port or range"),
+  inInterface: z8.string().optional().describe("Incoming interface"),
+  outInterface: z8.string().optional().describe("Outgoing interface"),
+  comment: z8.string().max(255).optional().describe("Comment to identify the rule (used as idempotency key)"),
+  disabled: z8.boolean().default(false).describe("Whether the rule should be disabled"),
+  placeBefore: z8.string().optional().describe("Place the new rule before this rule ID"),
+  dryRun: z8.boolean().default(false).describe("If true, validate and return planned changes without applying")
 }).strict();
 var manageFirewallRuleTool = {
   name: "manage_firewall_rule",
@@ -1419,13 +1371,17 @@ var manageFirewallRuleTool = {
         if (comment !== void 0) {
           const existing = await findRuleByComment(context, path, comment);
           if (existing) {
+            const wantProtocol = parsed.protocol !== void 0 && parsed.protocol !== "all" ? parsed.protocol : "";
             const sameChain = existing.chain === parsed.chain;
             const sameRuleAction = existing.action === parsed.ruleAction;
+            const sameSrcAddress = (existing["src-address"] ?? "") === (parsed.srcAddress ?? "");
+            const sameDstAddress = (existing["dst-address"] ?? "") === (parsed.dstAddress ?? "");
+            const sameProtocol = (existing.protocol ?? "") === wantProtocol;
             const sameSrcPort = (existing["src-port"] ?? "") === (parsed.srcPort ?? "");
             const sameDstPort = (existing["dst-port"] ?? "") === (parsed.dstPort ?? "");
             const sameInInterface = (existing["in-interface"] ?? "") === (parsed.inInterface ?? "");
             const sameOutInterface = (existing["out-interface"] ?? "") === (parsed.outInterface ?? "");
-            if (sameChain && sameRuleAction && sameSrcPort && sameDstPort && sameInInterface && sameOutInterface) {
+            if (sameChain && sameRuleAction && sameSrcAddress && sameDstAddress && sameProtocol && sameSrcPort && sameDstPort && sameInInterface && sameOutInterface) {
               return {
                 content: `Firewall ${parsed.table} rule with comment "${comment}" already exists. No changes made.`,
                 structuredContent: { action: "already_exists", rule: existing }
@@ -1439,6 +1395,9 @@ var manageFirewallRuleTool = {
                 existing: {
                   chain: existing.chain,
                   action: existing.action,
+                  "src-address": existing["src-address"],
+                  "dst-address": existing["dst-address"],
+                  protocol: existing.protocol,
                   "src-port": existing["src-port"],
                   "dst-port": existing["dst-port"],
                   "in-interface": existing["in-interface"],
@@ -1447,6 +1406,9 @@ var manageFirewallRuleTool = {
                 requested: {
                   chain: parsed.chain,
                   action: parsed.ruleAction,
+                  "src-address": parsed.srcAddress,
+                  "dst-address": parsed.dstAddress,
+                  protocol: wantProtocol || void 0,
                   "src-port": parsed.srcPort,
                   "dst-port": parsed.dstPort,
                   "in-interface": parsed.inInterface,
@@ -1598,22 +1560,21 @@ var manageFirewallRuleTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_firewall_rule" });
+      throw toolError(err, context, "manage_firewall_rule");
     }
   }
 };
 var firewallTools = [listFirewallRulesTool, manageFirewallRuleTool];
 
 // src/domain/tools/diagnostic-tools.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var log7 = createLogger("diagnostic-tools");
-var pingInputSchema = z8.object({
-  routerId: z8.string().describe("Target router identifier from the router registry"),
-  address: z8.string().describe("Target IP address or hostname to ping"),
-  count: z8.number().int().min(1).max(20).default(4).describe("Number of ICMP echo requests (1\u201320)"),
-  size: z8.number().int().min(14).max(65535).default(56).describe("Packet size in bytes (14\u201365535)"),
-  routingTable: z8.string().optional().describe("Routing table to use for the ping")
+var pingInputSchema = z9.object({
+  routerId,
+  address: z9.string().describe("Target IP address or hostname to ping"),
+  count: z9.number().int().min(1).max(20).default(4).describe("Number of ICMP echo requests (1\u201320)"),
+  size: z9.number().int().min(14).max(65535).default(56).describe("Packet size in bytes (14\u201365535)"),
+  routingTable: z9.string().optional().describe("Routing table to use for the ping")
 }).strict();
 var pingTool = {
   name: "ping",
@@ -1658,15 +1619,15 @@ var pingTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "ping" });
+      throw toolError(err, context, "ping");
     }
   }
 };
-var tracerouteInputSchema = z8.object({
-  routerId: z8.string().describe("Target router identifier from the router registry"),
-  address: z8.string().describe("Target IP address or hostname to trace"),
-  count: z8.number().int().min(1).max(5).default(3).describe("Probes per hop (1\u20135)"),
-  maxHops: z8.number().int().min(1).max(30).default(15).describe("Maximum number of hops (1\u201330)")
+var tracerouteInputSchema = z9.object({
+  routerId,
+  address: z9.string().describe("Target IP address or hostname to trace"),
+  count: z9.number().int().min(1).max(5).default(3).describe("Probes per hop (1\u20135)"),
+  maxHops: z9.number().int().min(1).max(30).default(15).describe("Maximum number of hops (1\u201330)")
 }).strict();
 var tracerouteTool = {
   name: "traceroute",
@@ -1713,16 +1674,16 @@ var tracerouteTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "traceroute" });
+      throw toolError(err, context, "traceroute");
     }
   }
 };
-var torchInputSchema = z8.object({
-  routerId: z8.string().describe("Target router identifier from the router registry"),
-  interface: z8.string().describe("Interface name to monitor (e.g. ether1, bridge1)"),
-  duration: z8.number().int().min(1).max(30).default(5).describe("Capture duration in seconds (1\u201330)"),
-  srcAddress: z8.string().optional().describe("Filter by source IP address"),
-  dstAddress: z8.string().optional().describe("Filter by destination IP address")
+var torchInputSchema = z9.object({
+  routerId,
+  interface: z9.string().describe("Interface name to monitor (e.g. ether1, bridge1)"),
+  duration: z9.number().int().min(1).max(30).default(5).describe("Capture duration in seconds (1\u201330)"),
+  srcAddress: z9.string().optional().describe("Filter by source IP address"),
+  dstAddress: z9.string().optional().describe("Filter by destination IP address")
 }).strict();
 function parseTorchOutput(output) {
   const flows = [];
@@ -1778,19 +1739,19 @@ var torchTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "torch" });
+      throw toolError(err, context, "torch");
     }
   }
 };
-var getLogInputSchema = z8.object({
-  routerId: z8.string().describe("Target router identifier from the router registry"),
-  limit: z8.number().int().min(1).max(500).default(100).describe("Maximum entries to return (1\u2013500)"),
-  offset: z8.number().int().min(0).default(0).describe("Pagination offset"),
-  topics: z8.array(z8.string()).optional().describe(
+var getLogInputSchema = z9.object({
+  routerId,
+  limit,
+  offset,
+  topics: z9.array(z9.string()).optional().describe(
     'Filter entries whose topics field contains any of these strings (e.g. ["firewall", "dhcp"])'
   ),
-  prefix: z8.string().optional().describe("Substring to match against the log message"),
-  sinceMinutes: z8.number().int().min(1).max(1440).optional().describe("Only return entries from the last N minutes (1\u20131440)")
+  prefix: z9.string().optional().describe("Substring to match against the log message"),
+  sinceMinutes: z9.number().int().min(1).max(1440).optional().describe("Only return entries from the last N minutes (1\u20131440)")
 }).strict();
 function parseRouterOsTimestamp(ts, now) {
   const timeOnly = /^(\d{2}):(\d{2}):(\d{2})$/.exec(ts);
@@ -1871,8 +1832,7 @@ var getLogTool = {
           return parsedTs >= cutoff;
         });
       }
-      const total = filtered.length;
-      const paginated = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const { items: paginated, total } = paginate(filtered, parsed.offset, parsed.limit);
       const lines = [
         `Log on ${context.routerId}: ${total} matching entries, showing ${paginated.length} (offset ${parsed.offset})`
       ];
@@ -1891,14 +1851,14 @@ var getLogTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_log" });
+      throw toolError(err, context, "get_log");
     }
   }
 };
 var diagnosticTools = [pingTool, tracerouteTool, torchTool, getLogTool];
 
 // src/domain/tools/system-ops-tools.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/domain/tools/command-guard.ts
 var BUILTIN_DENY_PATTERNS = [
@@ -1961,8 +1921,8 @@ function checkCommand(command, policy) {
 
 // src/domain/tools/system-ops-tools.ts
 var log8 = createLogger("system-ops-tools");
-var getSystemClockInputSchema = z9.object({
-  routerId: z9.string().describe("Target router identifier from the router registry")
+var getSystemClockInputSchema = z10.object({
+  routerId
 }).strict();
 var getSystemClockTool = {
   name: "get_system_clock",
@@ -1992,16 +1952,16 @@ var getSystemClockTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_system_clock" });
+      throw toolError(err, context, "get_system_clock");
     }
   }
 };
-var setSystemClockInputSchema = z9.object({
-  routerId: z9.string().describe("Target router identifier from the router registry"),
-  date: z9.string().optional().describe("Date in RouterOS format: mon/dd/yyyy (e.g. jan/02/2006)"),
-  time: z9.string().optional().describe("Time in RouterOS format: hh:mm:ss (e.g. 15:04:05)"),
-  timeZoneName: z9.string().optional().describe("IANA timezone name (e.g. Europe/London, UTC)"),
-  dryRun: z9.boolean().default(false).describe("Preview changes without applying")
+var setSystemClockInputSchema = z10.object({
+  routerId,
+  date: z10.string().optional().describe("Date in RouterOS format: mon/dd/yyyy (e.g. jan/02/2006)"),
+  time: z10.string().optional().describe("Time in RouterOS format: hh:mm:ss (e.g. 15:04:05)"),
+  timeZoneName: z10.string().optional().describe("IANA timezone name (e.g. Europe/London, UTC)"),
+  dryRun
 }).strict();
 var setSystemClockTool = {
   name: "set_system_clock",
@@ -2059,15 +2019,14 @@ var setSystemClockTool = {
         structuredContent: { action: "updated", routerId: context.routerId, diff }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "set_system_clock" });
+      throw toolError(err, context, "set_system_clock");
     }
   }
 };
-var rebootInputSchema = z9.object({
-  routerId: z9.string().describe("Target router identifier from the router registry"),
-  delay: z9.number().int().min(0).max(3600).default(0).describe("Seconds before rebooting (0\u20133600)"),
-  dryRun: z9.boolean().default(false).describe("Preview the reboot without executing")
+var rebootInputSchema = z10.object({
+  routerId,
+  delay: z10.number().int().min(0).max(3600).default(0).describe("Seconds before rebooting (0\u20133600)"),
+  dryRun: z10.boolean().default(false).describe("Preview the reboot without executing")
 }).strict();
 var rebootTool = {
   name: "reboot",
@@ -2099,20 +2058,20 @@ var rebootTool = {
         structuredContent: { action: "rebooting", delay: parsed.delay, routerId: context.routerId }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "reboot" });
+      throw toolError(err, context, "reboot");
     }
   }
 };
 var OUTPUT_MAX_CHARS = 4e3;
-var runCommandInputSchema = z9.object({
-  routerId: z9.string().describe("Target router identifier from the router registry"),
-  command: z9.string().min(1).describe("RouterOS console command to execute"),
-  dryRun: z9.boolean().default(false).describe("Preview the command without executing (validates allow/deny policy only)")
+var runCommandInputSchema = z10.object({
+  routerId,
+  command: z10.string().min(1).describe("RouterOS console command to execute"),
+  dryRun: z10.boolean().default(false).describe("Preview the command without executing (validates allow/deny policy only)")
 }).strict();
 var runCommandTool = {
   name: "run_command",
   title: "Run Command",
-  description: "Execute an arbitrary RouterOS console command via SSH. Protected by a configurable allow/deny policy \u2014 built-in deny list blocks destructive commands; optionally restrict further with an explicit allow list (cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Use dedicated tools (reboot, etc.) for controlled operations. Output capped at 4000 characters.",
+  description: "Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters.",
   inputSchema: runCommandInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -2158,8 +2117,7 @@ ${output}`;
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "run_command" });
+      throw toolError(err, context, "run_command");
     }
   }
 };
@@ -2171,12 +2129,12 @@ var systemOpsTools = [
 ];
 
 // src/domain/tools/bridge-tools.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var log9 = createLogger("bridge-tools");
-var listBridgesInputSchema = z10.object({
-  routerId: z10.string().describe("Target router identifier from the router registry"),
-  limit: z10.number().int().min(1).max(500).default(100).describe("Maximum number of bridges to return"),
-  offset: z10.number().int().min(0).default(0).describe("Offset for pagination")
+var listBridgesInputSchema = z11.object({
+  routerId,
+  limit,
+  offset
 }).strict();
 var listBridgesTool = {
   name: "list_bridges",
@@ -2208,19 +2166,9 @@ var listBridgesTool = {
         const rec = b;
         return { ...rec, ports: portsByBridge[rec.name] ?? [] };
       });
-      const total = enriched.length;
-      const paginated = enriched.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`Bridges on ${context.routerId}: ${total} total`];
-      for (const b of paginated) {
-        const bRec = b;
-        const portList = b.ports.map((p) => p.interface).join(", ");
-        lines.push(
-          `  ${String(bRec.name)} [${b.ports.length} ports${portList ? ": " + portList : ""}]`
-        );
-      }
+      const { items: paginated, total, hasMore } = paginate(enriched, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("Bridges", context.routerId, paginated.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           bridges: paginated,
@@ -2231,17 +2179,17 @@ var listBridgesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_bridges" });
+      throw toolError(err, context, "list_bridges");
     }
   }
 };
-var manageBridgeInputSchema = z10.object({
-  routerId: z10.string().describe("Target router identifier from the router registry"),
-  action: z10.enum(["create", "remove"]).describe("Action to perform"),
-  name: z10.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("Bridge interface name"),
-  comment: z10.string().max(255).optional().describe("Optional comment"),
-  disabled: z10.boolean().default(false).describe("Whether the bridge should be disabled"),
-  dryRun: z10.boolean().default(false).describe("Preview changes without applying")
+var manageBridgeInputSchema = z11.object({
+  routerId,
+  action: z11.enum(["create", "remove"]).describe("Action to perform"),
+  name: z11.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("Bridge interface name"),
+  comment: z11.string().max(255).optional().describe("Optional comment"),
+  disabled: z11.boolean().default(false).describe("Whether the bridge should be disabled"),
+  dryRun
 }).strict();
 var manageBridgeTool = {
   name: "manage_bridge",
@@ -2325,17 +2273,16 @@ var manageBridgeTool = {
         structuredContent: { action: "removed", name: parsed.name, id: rec[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_bridge" });
+      throw toolError(err, context, "manage_bridge");
     }
   }
 };
-var manageBridgePortInputSchema = z10.object({
-  routerId: z10.string().describe("Target router identifier from the router registry"),
-  action: z10.enum(["add", "remove"]).describe("Action to perform"),
-  bridge: z10.string().describe("Bridge interface name"),
-  interface: z10.string().describe("Interface to add or remove as a bridge port"),
-  dryRun: z10.boolean().default(false).describe("Preview changes without applying")
+var manageBridgePortInputSchema = z11.object({
+  routerId,
+  action: z11.enum(["add", "remove"]).describe("Action to perform"),
+  bridge: z11.string().describe("Bridge interface name"),
+  interface: z11.string().describe("Interface to add or remove as a bridge port"),
+  dryRun
 }).strict();
 var manageBridgePortTool = {
   name: "manage_bridge_port",
@@ -2427,8 +2374,7 @@ var manageBridgePortTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_bridge_port" });
+      throw toolError(err, context, "manage_bridge_port");
     }
   }
 };
@@ -2439,7 +2385,7 @@ var bridgeTools = [
 ];
 
 // src/domain/tools/wifi-tools.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var log10 = createLogger("wifi-tools");
 function wifiPath(rosVersion) {
   return rosVersion.startsWith("7") ? "interface/wifi" : "interface/wireless";
@@ -2447,10 +2393,10 @@ function wifiPath(rosVersion) {
 function wifiRegistrationPath(rosVersion) {
   return rosVersion.startsWith("7") ? "interface/wifi/registration-table" : "interface/wireless/registration-table";
 }
-var listWifiInputSchema = z11.object({
-  routerId: z11.string().describe("Target router identifier from the router registry"),
-  limit: z11.number().int().min(1).max(500).default(100).describe("Maximum number of interfaces to return"),
-  offset: z11.number().int().min(0).default(0).describe("Offset for pagination")
+var listWifiInputSchema = z12.object({
+  routerId,
+  limit,
+  offset
 }).strict();
 var listWifiTool = {
   name: "list_wifi_interfaces",
@@ -2472,17 +2418,9 @@ var listWifiTool = {
         limit: void 0,
         offset: void 0
       });
-      const total = interfaces.length;
-      const paginated = interfaces.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`WiFi interfaces on ${context.routerId}: ${total} total`];
-      for (const iface of paginated) {
-        const rec = iface;
-        const status = rec.disabled === "true" ? "DISABLED" : "ENABLED";
-        lines.push(`  ${rec.name} [${rec.ssid ?? "no-ssid"}] ${status}`);
-      }
+      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("WiFi interfaces", context.routerId, paginated.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           interfaces: paginated,
@@ -2493,15 +2431,15 @@ var listWifiTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_wifi_interfaces" });
+      throw toolError(err, context, "list_wifi_interfaces");
     }
   }
 };
-var listWifiClientsInputSchema = z11.object({
-  routerId: z11.string().describe("Target router identifier from the router registry"),
-  interface: z11.string().optional().describe("Filter by WiFi interface name"),
-  limit: z11.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z11.number().int().min(0).default(0).describe("Offset for pagination")
+var listWifiClientsInputSchema = z12.object({
+  routerId,
+  interface: z12.string().optional().describe("Filter by WiFi interface name"),
+  limit,
+  offset
 }).strict();
 var listWifiClientsTool = {
   name: "list_wifi_clients",
@@ -2521,18 +2459,9 @@ var listWifiClientsTool = {
       const path = wifiRegistrationPath(context.routerConfig.rosVersion);
       const filter = parsed.interface ? { interface: parsed.interface } : void 0;
       const allClients = await context.routerClient.get(path, { filter });
-      const total = allClients.length;
-      const clients = allClients.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`WiFi clients on ${context.routerId}: ${total} total`];
-      for (const c of clients) {
-        const rec = c;
-        lines.push(
-          `  ${rec["mac-address"] ?? rec[".id"]} on ${rec.interface ?? "unknown"} signal=${rec["signal-strength"] ?? "?"}`
-        );
-      }
+      const { items: clients, total, hasMore } = paginate(allClients, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("WiFi clients", context.routerId, clients.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           clients,
@@ -2543,16 +2472,16 @@ var listWifiClientsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_wifi_clients" });
+      throw toolError(err, context, "list_wifi_clients");
     }
   }
 };
-var manageWifiInputSchema = z11.object({
-  routerId: z11.string().describe("Target router identifier from the router registry"),
-  name: z11.string().describe("WiFi interface name (e.g. wifi1, wlan1)"),
-  disabled: z11.boolean().optional().describe("Set to true to disable, false to enable"),
-  ssid: z11.string().max(32).optional().describe("New SSID to set"),
-  dryRun: z11.boolean().default(false).describe("Preview changes without applying")
+var manageWifiInputSchema = z12.object({
+  routerId,
+  name: z12.string().describe("WiFi interface name (e.g. wifi1, wlan1)"),
+  disabled: z12.boolean().optional().describe("Set to true to disable, false to enable"),
+  ssid: z12.string().max(32).optional().describe("New SSID to set"),
+  dryRun
 }).strict();
 var manageWifiTool = {
   name: "manage_wifi_interface",
@@ -2629,20 +2558,19 @@ var manageWifiTool = {
         structuredContent: { action: "updated", name: parsed.name, changes: diff }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_wifi_interface" });
+      throw toolError(err, context, "manage_wifi_interface");
     }
   }
 };
 var wifiTools = [listWifiTool, listWifiClientsTool, manageWifiTool];
 
 // src/domain/tools/wireguard-tools.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var log11 = createLogger("wireguard-tools");
-var listWgInputSchema = z12.object({
-  routerId: z12.string().describe("Target router identifier from the router registry"),
-  limit: z12.number().int().min(1).max(500).default(100).describe("Maximum number of interfaces to return"),
-  offset: z12.number().int().min(0).default(0).describe("Offset for pagination")
+var listWgInputSchema = z13.object({
+  routerId,
+  limit,
+  offset
 }).strict();
 var listWgTool = {
   name: "list_wireguard_interfaces",
@@ -2663,17 +2591,15 @@ var listWgTool = {
         limit: void 0,
         offset: void 0
       });
-      const total = interfaces.length;
-      const paginated = interfaces.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`WireGuard interfaces on ${context.routerId}: ${total} total`];
-      for (const iface of paginated) {
-        const rec = iface;
-        const running = rec.running === "true" ? "UP" : "DOWN";
-        lines.push(`  ${rec.name} [port=${rec["listen-port"] ?? "?"}] ${running}`);
-      }
+      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary(
+          "WireGuard interfaces",
+          context.routerId,
+          paginated.length,
+          total,
+          parsed.offset
+        ),
         structuredContent: {
           routerId: context.routerId,
           interfaces: paginated,
@@ -2684,15 +2610,15 @@ var listWgTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_wireguard_interfaces" });
+      throw toolError(err, context, "list_wireguard_interfaces");
     }
   }
 };
-var listPeersInputSchema = z12.object({
-  routerId: z12.string().describe("Target router identifier from the router registry"),
-  interface: z12.string().optional().describe("Filter by WireGuard interface name"),
-  limit: z12.number().int().min(1).max(500).default(100).describe("Maximum number of peers to return"),
-  offset: z12.number().int().min(0).default(0).describe("Offset for pagination")
+var listPeersInputSchema = z13.object({
+  routerId,
+  interface: z13.string().optional().describe("Filter by WireGuard interface name"),
+  limit,
+  offset
 }).strict();
 var listPeersTool = {
   name: "list_wireguard_peers",
@@ -2716,19 +2642,9 @@ var listPeersTool = {
       const allPeers = await context.routerClient.get("interface/wireguard/peers", {
         filter
       });
-      const total = allPeers.length;
-      const peers = allPeers.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`WireGuard peers on ${context.routerId}: ${total} total`];
-      for (const peer of peers) {
-        const rec = peer;
-        const key2 = rec["public-key"] ? rec["public-key"].slice(0, 8) + "\u2026" : "unknown";
-        lines.push(
-          `  [${rec.interface ?? "?"}] ${key2} last-handshake=${rec["last-handshake"] ?? "never"}`
-        );
-      }
+      const { items: peers, total, hasMore } = paginate(allPeers, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("WireGuard peers", context.routerId, peers.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           peers,
@@ -2739,19 +2655,19 @@ var listPeersTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_wireguard_peers" });
+      throw toolError(err, context, "list_wireguard_peers");
     }
   }
 };
-var managePeerInputSchema = z12.object({
-  routerId: z12.string().describe("Target router identifier from the router registry"),
-  action: z12.enum(["add", "remove"]).describe("Action to perform"),
-  interface: z12.string().describe("WireGuard interface name (e.g. wg0)"),
-  publicKey: z12.string().min(1).describe("Peer public key in base64 format (44 characters)"),
-  allowedAddress: z12.string().optional().describe("Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)"),
-  endpoint: z12.string().optional().describe("Peer endpoint as IP:port (e.g. 1.2.3.4:51820)"),
-  comment: z12.string().max(255).optional().describe("Optional comment"),
-  dryRun: z12.boolean().default(false).describe("Preview changes without applying")
+var managePeerInputSchema = z13.object({
+  routerId,
+  action: z13.enum(["add", "remove"]).describe("Action to perform"),
+  interface: z13.string().describe("WireGuard interface name (e.g. wg0)"),
+  publicKey: z13.string().min(1).describe("Peer public key in base64 format (44 characters)"),
+  allowedAddress: z13.string().optional().describe("Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)"),
+  endpoint: z13.string().optional().describe("Peer endpoint as IP:port (e.g. 1.2.3.4:51820)"),
+  comment: z13.string().max(255).optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var managePeerTool = {
   name: "manage_wireguard_peer",
@@ -2837,19 +2753,18 @@ var managePeerTool = {
         structuredContent: { action: "removed", interface: parsed.interface, id: rec[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_wireguard_peer" });
+      throw toolError(err, context, "manage_wireguard_peer");
     }
   }
 };
-var manageWgIfaceInputSchema = z12.object({
-  routerId: z12.string().describe("Target router identifier from the router registry"),
-  action: z12.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z12.string().describe("Interface name \u2014 idempotency key (e.g. wg0)"),
-  listenPort: z12.number().int().min(1).max(65535).optional().describe("UDP listen port (RouterOS picks one if omitted)"),
-  mtu: z12.number().int().min(1280).max(65535).default(1420).describe("MTU (default 1420)"),
-  comment: z12.string().optional().describe("Optional comment"),
-  dryRun: z12.boolean().default(false).describe("Preview changes without applying")
+var manageWgIfaceInputSchema = z13.object({
+  routerId,
+  action: z13.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z13.string().describe("Interface name \u2014 idempotency key (e.g. wg0)"),
+  listenPort: z13.number().int().min(1).max(65535).optional().describe("UDP listen port (RouterOS picks one if omitted)"),
+  mtu: z13.number().int().min(1280).max(65535).default(1420).describe("MTU (default 1420)"),
+  comment: z13.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageWgIfaceTool = {
   name: "manage_wireguard_interface",
@@ -2973,8 +2888,7 @@ var manageWgIfaceTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_wireguard_interface" });
+      throw toolError(err, context, "manage_wireguard_interface");
     }
   }
 };
@@ -2986,14 +2900,14 @@ var wireguardTools = [
 ];
 
 // src/domain/tools/dns-tools.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var log12 = createLogger("dns-tools");
-var listDnsInputSchema = z13.object({
-  routerId: z13.string().describe("Target router identifier from the router registry"),
-  name: z13.string().optional().describe("Filter by hostname (partial match)"),
-  type: z13.enum(["A", "CNAME", "TXT", "all"]).default("all").describe("Filter by record type"),
-  limit: z13.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return"),
-  offset: z13.number().int().min(0).default(0).describe("Offset for pagination")
+var listDnsInputSchema = z14.object({
+  routerId,
+  name: z14.string().optional().describe("Filter by hostname (partial match)"),
+  type: z14.enum(["A", "CNAME", "TXT", "all"]).default("all").describe("Filter by record type"),
+  limit,
+  offset
 }).strict();
 var listDnsTool = {
   name: "list_dns_entries",
@@ -3023,17 +2937,9 @@ var listDnsTool = {
           (e) => (e.name ?? "").toLowerCase().includes(needle)
         );
       }
-      const total = entries.length;
-      const paginated = entries.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [`DNS entries on ${context.routerId}: ${total} total`];
-      for (const entry of paginated) {
-        const rec = entry;
-        const value = rec.address ?? rec.cname ?? rec.text ?? "?";
-        lines.push(`  ${rec.name} ${rec.type ?? "A"} \u2192 ${value}`);
-      }
+      const { items: paginated, total, hasMore } = paginate(entries, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("DNS entries", context.routerId, paginated.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           entries: paginated,
@@ -3044,22 +2950,22 @@ var listDnsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dns_entries" });
-    }
-  }
-};
-var manageDnsInputSchema = z13.object({
-  routerId: z13.string().describe("Target router identifier from the router registry"),
-  action: z13.enum(["add", "remove"]).describe("Action to perform"),
-  name: z13.string().min(1).describe("Hostname for the DNS record (e.g. server.example.com)"),
-  type: z13.enum(["A", "CNAME", "TXT"]).default("A").describe("DNS record type"),
-  address: z13.string().optional().describe("IP address (required for A records)"),
-  cname: z13.string().optional().describe("Target hostname (required for CNAME records)"),
-  text: z13.string().optional().describe("Text value (required for TXT records)"),
-  ttl: z13.string().optional().describe("TTL value (e.g. 1d, 00:05:00)"),
-  comment: z13.string().max(255).optional().describe("Optional comment"),
-  disabled: z13.boolean().default(false).describe("Whether the entry should be disabled"),
-  dryRun: z13.boolean().default(false).describe("Preview changes without applying")
+      throw toolError(err, context, "list_dns_entries");
+    }
+  }
+};
+var manageDnsInputSchema = z14.object({
+  routerId,
+  action: z14.enum(["add", "remove"]).describe("Action to perform"),
+  name: z14.string().min(1).describe("Hostname for the DNS record (e.g. server.example.com)"),
+  type: z14.enum(["A", "CNAME", "TXT"]).default("A").describe("DNS record type"),
+  address: z14.string().optional().describe("IP address (required for A records)"),
+  cname: z14.string().optional().describe("Target hostname (required for CNAME records)"),
+  text: z14.string().optional().describe("Text value (required for TXT records)"),
+  ttl: z14.string().optional().describe("TTL value (e.g. 1d, 00:05:00)"),
+  comment: z14.string().max(255).optional().describe("Optional comment"),
+  disabled: z14.boolean().default(false).describe("Whether the entry should be disabled"),
+  dryRun
 }).strict();
 var manageDnsTool = {
   name: "manage_dns_entry",
@@ -3178,13 +3084,12 @@ var manageDnsTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dns_entry" });
+      throw toolError(err, context, "manage_dns_entry");
     }
   }
 };
-var getDnsSettingsInputSchema = z13.object({
-  routerId: z13.string().describe("Target router identifier from the router registry")
+var getDnsSettingsInputSchema = z14.object({
+  routerId
 }).strict();
 var getDnsSettingsTool = {
   name: "get_dns_settings",
@@ -3218,18 +3123,18 @@ var getDnsSettingsTool = {
         structuredContent: { routerId: context.routerId, settings }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_dns_settings" });
+      throw toolError(err, context, "get_dns_settings");
     }
   }
 };
-var manageDnsSettingsInputSchema = z13.object({
-  routerId: z13.string().describe("Target router identifier from the router registry"),
-  servers: z13.string().optional().describe("Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1')"),
-  allowRemoteRequests: z13.boolean().optional().describe("Allow router to answer DNS queries from the network"),
-  maxUdpPacketSize: z13.number().int().min(512).max(65535).optional().describe("Maximum UDP packet size in bytes"),
-  cacheMaxTtl: z13.string().optional().describe("Maximum cache TTL (e.g. '1d', '00:30:00')"),
-  cacheSize: z13.number().int().min(1).optional().describe("DNS cache size in KiB"),
-  dryRun: z13.boolean().default(false).describe("Preview changes without applying")
+var manageDnsSettingsInputSchema = z14.object({
+  routerId,
+  servers: z14.string().optional().describe("Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1')"),
+  allowRemoteRequests: z14.boolean().optional().describe("Allow router to answer DNS queries from the network"),
+  maxUdpPacketSize: z14.number().int().min(512).max(65535).optional().describe("Maximum UDP packet size in bytes"),
+  cacheMaxTtl: z14.string().optional().describe("Maximum cache TTL (e.g. '1d', '00:30:00')"),
+  cacheSize: z14.number().int().min(1).optional().describe("DNS cache size in KiB"),
+  dryRun
 }).strict();
 var manageDnsSettingsTool = {
   name: "manage_dns_settings",
@@ -3300,14 +3205,14 @@ var manageDnsSettingsTool = {
         structuredContent: { action: "updated", routerId: context.routerId, diff }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dns_settings" });
+      throw toolError(err, context, "manage_dns_settings");
     }
   }
 };
 var dnsTools = [listDnsTool, manageDnsTool, getDnsSettingsTool, manageDnsSettingsTool];
 
 // src/domain/tools/mangle-tools.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var log13 = createLogger("mangle-tools");
 var MANGLE_PATH = "ip/firewall/mangle";
 async function findMangleRuleByComment(context, comment) {
@@ -3316,11 +3221,11 @@ async function findMangleRuleByComment(context, comment) {
   });
   return results2.length > 0 ? results2[0] : void 0;
 }
-var listMangleRulesInputSchema = z14.object({
-  routerId: z14.string().describe("Target router identifier from the router registry"),
-  chain: z14.string().optional().describe("Filter by chain name (e.g. prerouting, forward, postrouting)"),
-  action: z14.string().optional().describe("Filter by mangle action (e.g. mark-routing, mark-connection)"),
-  disabled: z14.boolean().optional().describe("Filter by disabled state")
+var listMangleRulesInputSchema = z15.object({
+  routerId,
+  chain: z15.string().optional().describe("Filter by chain name (e.g. prerouting, forward, postrouting)"),
+  action: z15.string().optional().describe("Filter by mangle action (e.g. mark-routing, mark-connection)"),
+  disabled: z15.boolean().optional().describe("Filter by disabled state")
 }).strict();
 var listMangleRulesTool = {
   name: "list_mangle_rules",
@@ -3359,30 +3264,29 @@ var listMangleRulesTool = {
         structuredContent: { routerId: context.routerId, rules, total: rules.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_mangle_rules" });
-    }
-  }
-};
-var manageMangleRuleInputSchema = z14.object({
-  routerId: z14.string().describe("Target router identifier from the router registry"),
-  action: z14.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  comment: z14.string().describe("Idempotency key \u2014 uniquely identifies this mangle rule"),
-  chain: z14.string().optional().describe("Mangle chain (required on add): prerouting, input, forward, output, postrouting"),
-  dryRun: z14.boolean().default(false).describe("Preview changes without applying"),
-  srcAddress: z14.string().optional().describe("Source IP/CIDR to match"),
-  dstAddress: z14.string().optional().describe("Destination IP/CIDR to match"),
-  srcAddressList: z14.string().optional().describe("Source address list name to match"),
-  dstAddressList: z14.string().optional().describe("Destination address list name to match"),
-  protocol: z14.string().optional().describe("Protocol to match (e.g. tcp, udp)"),
-  srcPort: z14.string().optional().describe("Source port or range"),
-  dstPort: z14.string().optional().describe("Destination port or range"),
-  inInterface: z14.string().optional().describe("Incoming interface to match"),
-  outInterface: z14.string().optional().describe("Outgoing interface to match"),
-  newRoutingMark: z14.string().optional().describe("Routing mark to set"),
-  newConnectionMark: z14.string().optional().describe("Connection mark to set"),
-  newDscpValue: z14.number().int().min(0).max(63).optional().describe("DSCP value to set (0\u201363)"),
-  passthrough: z14.boolean().optional().describe("Whether to continue matching subsequent rules")
+      throw toolError(err, context, "list_mangle_rules");
+    }
+  }
+};
+var manageMangleRuleInputSchema = z15.object({
+  routerId,
+  action: z15.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  comment: z15.string().describe("Idempotency key \u2014 uniquely identifies this mangle rule"),
+  chain: z15.string().optional().describe("Mangle chain (required on add): prerouting, input, forward, output, postrouting"),
+  dryRun,
+  srcAddress: z15.string().optional().describe("Source IP/CIDR to match"),
+  dstAddress: z15.string().optional().describe("Destination IP/CIDR to match"),
+  srcAddressList: z15.string().optional().describe("Source address list name to match"),
+  dstAddressList: z15.string().optional().describe("Destination address list name to match"),
+  protocol: z15.string().optional().describe("Protocol to match (e.g. tcp, udp)"),
+  srcPort: z15.string().optional().describe("Source port or range"),
+  dstPort: z15.string().optional().describe("Destination port or range"),
+  inInterface: z15.string().optional().describe("Incoming interface to match"),
+  outInterface: z15.string().optional().describe("Outgoing interface to match"),
+  newRoutingMark: z15.string().optional().describe("Routing mark to set"),
+  newConnectionMark: z15.string().optional().describe("Connection mark to set"),
+  newDscpValue: z15.number().int().min(0).max(63).optional().describe("DSCP value to set (0\u201363)"),
+  passthrough: z15.boolean().optional().describe("Whether to continue matching subsequent rules")
 }).strict();
 var manageMangleRuleTool = {
   name: "manage_mangle_rule",
@@ -3567,21 +3471,20 @@ var manageMangleRuleTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_mangle_rule" });
+      throw toolError(err, context, "manage_mangle_rule");
     }
   }
 };
 var mangleTools = [listMangleRulesTool, manageMangleRuleTool];
 
 // src/domain/tools/address-list-tools.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var log14 = createLogger("address-list-tools");
 var ADDRESS_LIST_PATH = "ip/firewall/address-list";
-var listAddressListInputSchema = z15.object({
-  routerId: z15.string().describe("Target router identifier from the router registry"),
-  list: z15.string().optional().describe("Filter by address list name"),
-  address: z15.string().optional().describe("Filter by address (IP or CIDR)")
+var listAddressListInputSchema = z16.object({
+  routerId,
+  list: z16.string().optional().describe("Filter by address list name"),
+  address: z16.string().optional().describe("Filter by address (IP or CIDR)")
 }).strict();
 var listAddressListTool = {
   name: "list_address_list_entries",
@@ -3611,19 +3514,18 @@ var listAddressListTool = {
         structuredContent: { routerId: context.routerId, entries, total: entries.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_address_list_entries" });
+      throw toolError(err, context, "list_address_list_entries");
     }
   }
 };
-var manageAddressListInputSchema = z15.object({
-  routerId: z15.string().describe("Target router identifier from the router registry"),
-  action: z15.enum(["add", "remove"]).describe("Action to perform"),
-  list: z15.string().describe("Address list name"),
-  address: z15.string().describe("IP address or CIDR to add/remove"),
-  comment: z15.string().optional().describe("Optional comment for the entry"),
-  timeout: z15.string().optional().describe("Expiry timeout (e.g. 1d, 2h30m) \u2014 omit for permanent"),
-  dryRun: z15.boolean().default(false).describe("Preview changes without applying")
+var manageAddressListInputSchema = z16.object({
+  routerId,
+  action: z16.enum(["add", "remove"]).describe("Action to perform"),
+  list: z16.string().describe("Address list name"),
+  address: z16.string().describe("IP address or CIDR to add/remove"),
+  comment: z16.string().optional().describe("Optional comment for the entry"),
+  timeout: z16.string().optional().describe("Expiry timeout (e.g. 1d, 2h30m) \u2014 omit for permanent"),
+  dryRun
 }).strict();
 var manageAddressListTool = {
   name: "manage_address_list_entry",
@@ -3716,22 +3618,21 @@ var manageAddressListTool = {
         recoverability: { retryable: false, suggestedAction: "Use one of: add, remove." }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_address_list_entry" });
+      throw toolError(err, context, "manage_address_list_entry");
     }
   }
 };
 var addressListTools = [listAddressListTool, manageAddressListTool];
 
 // src/domain/tools/policy-routing-tools.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var log15 = createLogger("policy-routing-tools");
 var ROUTING_RULE_PATH = "routing/rule";
 var ROUTING_TABLE_PATH = "routing/table";
-var listRoutingRulesInputSchema = z16.object({
-  routerId: z16.string().describe("Target router identifier from the router registry"),
-  table: z16.string().optional().describe("Filter by routing table name"),
-  disabled: z16.boolean().optional().describe("Filter by disabled state")
+var listRoutingRulesInputSchema = z17.object({
+  routerId,
+  table: z17.string().optional().describe("Filter by routing table name"),
+  disabled: z17.boolean().optional().describe("Filter by disabled state")
 }).strict();
 var listRoutingRulesTool = {
   name: "list_routing_rules",
@@ -3767,22 +3668,21 @@ var listRoutingRulesTool = {
         structuredContent: { routerId: context.routerId, rules, total: rules.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_routing_rules" });
+      throw toolError(err, context, "list_routing_rules");
     }
   }
 };
-var manageRoutingRuleInputSchema = z16.object({
-  routerId: z16.string().describe("Target router identifier from the router registry"),
-  action: z16.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  table: z16.string().describe(
+var manageRoutingRuleInputSchema = z17.object({
+  routerId,
+  action: z17.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  table: z17.string().describe(
     "Routing table name \u2014 part of the composite idempotency key; required for all actions"
   ),
-  srcAddress: z16.string().optional().describe("Source CIDR to match"),
-  dstAddress: z16.string().optional().describe("Destination CIDR to match"),
-  interface: z16.string().optional().describe("Incoming interface to match"),
-  priority: z16.number().int().min(0).max(4294967295).optional().describe("Rule priority (0\u20134294967295)"),
-  dryRun: z16.boolean().default(false).describe("Preview changes without applying")
+  srcAddress: z17.string().optional().describe("Source CIDR to match"),
+  dstAddress: z17.string().optional().describe("Destination CIDR to match"),
+  interface: z17.string().optional().describe("Incoming interface to match"),
+  priority: z17.number().int().min(0).max(4294967295).optional().describe("Rule priority (0\u20134294967295)"),
+  dryRun
 }).strict();
 function findRoutingRule(rules, srcAddress, dstAddress, iface, table) {
   return rules.find((r) => {
@@ -3938,13 +3838,12 @@ var manageRoutingRuleTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_routing_rule" });
+      throw toolError(err, context, "manage_routing_rule");
     }
   }
 };
-var listRoutingTablesInputSchema = z16.object({
-  routerId: z16.string().describe("Target router identifier from the router registry")
+var listRoutingTablesInputSchema = z17.object({
+  routerId
 }).strict();
 var listRoutingTablesTool = {
   name: "list_routing_tables",
@@ -3970,17 +3869,16 @@ var listRoutingTablesTool = {
         structuredContent: { routerId: context.routerId, tables, total: tables.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_routing_tables" });
+      throw toolError(err, context, "list_routing_tables");
     }
   }
 };
-var manageRoutingTableInputSchema = z16.object({
-  routerId: z16.string().describe("Target router identifier from the router registry"),
-  action: z16.enum(["add", "remove"]).describe("Action to perform"),
-  name: z16.string().describe("Routing table name (idempotency key)"),
-  fib: z16.boolean().default(false).describe("Whether to sync this table with the FIB"),
-  dryRun: z16.boolean().default(false).describe("Preview changes without applying")
+var manageRoutingTableInputSchema = z17.object({
+  routerId,
+  action: z17.enum(["add", "remove"]).describe("Action to perform"),
+  name: z17.string().describe("Routing table name (idempotency key)"),
+  fib: z17.boolean().default(false).describe("Whether to sync this table with the FIB"),
+  dryRun
 }).strict();
 var manageRoutingTableTool = {
   name: "manage_routing_table",
@@ -4062,8 +3960,7 @@ var manageRoutingTableTool = {
         recoverability: { retryable: false, suggestedAction: "Use one of: add, remove." }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_routing_table" });
+      throw toolError(err, context, "manage_routing_table");
     }
   }
 };
@@ -4075,11 +3972,11 @@ var policyRoutingTools = [
 ];
 
 // src/domain/tools/routing-protocol-tools.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var log16 = createLogger("routing-protocol-tools");
-var listBgpPeersInputSchema = z17.object({
-  routerId: z17.string().describe("Target router identifier from the router registry"),
-  state: z17.string().optional().describe("Filter by session state (e.g. established, active, idle)")
+var listBgpPeersInputSchema = z18.object({
+  routerId,
+  state: z18.string().optional().describe("Filter by session state (e.g. established, active, idle)")
 }).strict();
 var listBgpPeersTool = {
   name: "list_bgp_peers",
@@ -4108,14 +4005,13 @@ var listBgpPeersTool = {
         structuredContent: { routerId: context.routerId, sessions, total: sessions.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_bgp_peers" });
+      throw toolError(err, context, "list_bgp_peers");
     }
   }
 };
-var listOspfNeighborsInputSchema = z17.object({
-  routerId: z17.string().describe("Target router identifier from the router registry"),
-  state: z17.string().optional().describe("Filter by neighbor state (e.g. full, 2-way, init)")
+var listOspfNeighborsInputSchema = z18.object({
+  routerId,
+  state: z18.string().optional().describe("Filter by neighbor state (e.g. full, 2-way, init)")
 }).strict();
 var listOspfNeighborsTool = {
   name: "list_ospf_neighbors",
@@ -4144,20 +4040,19 @@ var listOspfNeighborsTool = {
         structuredContent: { routerId: context.routerId, neighbors, total: neighbors.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ospf_neighbors" });
+      throw toolError(err, context, "list_ospf_neighbors");
     }
   }
 };
 var routingProtocolTools = [listBgpPeersTool, listOspfNeighborsTool];
 
 // src/domain/tools/scripts-tools.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var log17 = createLogger("scripts-tools");
 var SCRIPT_PATH = "system/script";
-var listScriptsInputSchema = z18.object({
-  routerId: z18.string().describe("Target router identifier from the router registry"),
-  name: z18.string().optional().describe("Filter by script name (substring match)")
+var listScriptsInputSchema = z19.object({
+  routerId,
+  name: z19.string().optional().describe("Filter by script name (substring match)")
 }).strict();
 var listScriptsTool = {
   name: "list_scripts",
@@ -4189,19 +4084,18 @@ var listScriptsTool = {
         structuredContent: { routerId: context.routerId, scripts, total: scripts.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_scripts" });
+      throw toolError(err, context, "list_scripts");
     }
   }
 };
-var manageScriptInputSchema = z18.object({
-  routerId: z18.string().describe("Target router identifier from the router registry"),
-  action: z18.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z18.string().describe("Script name \u2014 idempotency key"),
-  source: z18.string().optional().describe("Script body (required for add and update)"),
-  comment: z18.string().optional().describe("Optional comment"),
-  dontRequirePermissions: z18.boolean().optional().describe("Allow script to run without elevated permissions"),
-  dryRun: z18.boolean().default(false).describe("Preview changes without applying")
+var manageScriptInputSchema = z19.object({
+  routerId,
+  action: z19.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z19.string().describe("Script name \u2014 idempotency key"),
+  source: z19.string().optional().describe("Script body (required for add and update)"),
+  comment: z19.string().optional().describe("Optional comment"),
+  dontRequirePermissions: z19.boolean().optional().describe("Allow script to run without elevated permissions"),
+  dryRun
 }).strict();
 var manageScriptTool = {
   name: "manage_script",
@@ -4340,14 +4234,13 @@ var manageScriptTool = {
         recoverability: { retryable: false, suggestedAction: "Use one of: add, update, remove." }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_script" });
+      throw toolError(err, context, "manage_script");
     }
   }
 };
-var runScriptInputSchema = z18.object({
-  routerId: z18.string().describe("Target router identifier from the router registry"),
-  name: z18.string().describe("Name of the script to execute")
+var runScriptInputSchema = z19.object({
+  routerId,
+  name: z19.string().describe("Name of the script to execute")
 }).strict();
 var runScriptTool = {
   name: "run_script",
@@ -4389,20 +4282,19 @@ var runScriptTool = {
         structuredContent: { action: "executed", name: parsed.name }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "run_script" });
+      throw toolError(err, context, "run_script");
     }
   }
 };
 var scriptsTools = [listScriptsTool, manageScriptTool, runScriptTool];
 
 // src/domain/tools/scheduler-tools.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var log18 = createLogger("scheduler-tools");
 var SCHEDULER_PATH = "system/scheduler";
-var listScheduledJobsInputSchema = z19.object({
-  routerId: z19.string().describe("Target router identifier from the router registry"),
-  name: z19.string().optional().describe("Filter by job name (exact match)")
+var listScheduledJobsInputSchema = z20.object({
+  routerId,
+  name: z20.string().optional().describe("Filter by job name (exact match)")
 }).strict();
 var listScheduledJobsTool = {
   name: "list_scheduled_jobs",
@@ -4431,21 +4323,20 @@ var listScheduledJobsTool = {
         structuredContent: { routerId: context.routerId, jobs, total: jobs.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_scheduled_jobs" });
+      throw toolError(err, context, "list_scheduled_jobs");
     }
   }
 };
-var manageScheduledJobInputSchema = z19.object({
-  routerId: z19.string().describe("Target router identifier from the router registry"),
-  action: z19.enum(["add", "update", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z19.string().describe("Job name \u2014 idempotency key"),
-  onEvent: z19.string().optional().describe("Script name or inline command to run (required on add)"),
-  startDate: z19.string().optional().describe("Start date (e.g. jan/01/2000)"),
-  startTime: z19.string().optional().describe("Start time (e.g. 00:00:00)"),
-  interval: z19.string().optional().describe("Run interval (e.g. 00:05:00 for every 5 minutes)"),
-  comment: z19.string().optional().describe("Optional comment"),
-  dryRun: z19.boolean().default(false).describe("Preview changes without applying")
+var manageScheduledJobInputSchema = z20.object({
+  routerId,
+  action: z20.enum(["add", "update", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z20.string().describe("Job name \u2014 idempotency key"),
+  onEvent: z20.string().optional().describe("Script name or inline command to run (required on add)"),
+  startDate: z20.string().optional().describe("Start date (e.g. jan/01/2000)"),
+  startTime: z20.string().optional().describe("Start time (e.g. 00:00:00)"),
+  interval: z20.string().optional().describe("Run interval (e.g. 00:05:00 for every 5 minutes)"),
+  comment: z20.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageScheduledJobTool = {
   name: "manage_scheduled_job",
@@ -4637,20 +4528,19 @@ var manageScheduledJobTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_scheduled_job" });
+      throw toolError(err, context, "manage_scheduled_job");
     }
   }
 };
 var schedulerTools = [listScheduledJobsTool, manageScheduledJobTool];
 
 // src/domain/tools/packages-tools.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var log19 = createLogger("packages-tools");
 var PACKAGE_PATH = "system/package";
-var listPackagesInputSchema = z20.object({
-  routerId: z20.string().describe("Target router identifier from the router registry"),
-  name: z20.string().optional().describe("Filter by package name (exact match)")
+var listPackagesInputSchema = z21.object({
+  routerId,
+  name: z21.string().optional().describe("Filter by package name (exact match)")
 }).strict();
 var listPackagesTool = {
   name: "list_packages",
@@ -4679,16 +4569,15 @@ var listPackagesTool = {
         structuredContent: { routerId: context.routerId, packages, total: packages.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_packages" });
+      throw toolError(err, context, "list_packages");
     }
   }
 };
-var managePackageInputSchema = z20.object({
-  routerId: z20.string().describe("Target router identifier from the router registry"),
-  action: z20.enum(["enable", "disable"]).describe("Action to perform"),
-  name: z20.string().describe("Package name"),
-  dryRun: z20.boolean().default(false).describe("Preview changes without applying")
+var managePackageInputSchema = z21.object({
+  routerId,
+  action: z21.enum(["enable", "disable"]).describe("Action to perform"),
+  name: z21.string().describe("Package name"),
+  dryRun
 }).strict();
 var managePackageTool = {
   name: "manage_package",
@@ -4754,21 +4643,20 @@ var managePackageTool = {
         structuredContent: { action: "updated", name: parsed.name, id }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_package" });
+      throw toolError(err, context, "manage_package");
     }
   }
 };
 var packagesTools = [listPackagesTool, managePackageTool];
 
 // src/domain/tools/files-tools.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var log20 = createLogger("files-tools");
 var FILE_PATH = "file";
-var listFilesInputSchema = z21.object({
-  routerId: z21.string().describe("Target router identifier from the router registry"),
-  name: z21.string().optional().describe("Filter by file name (substring match)"),
-  type: z21.string().optional().describe("Filter by file type (e.g. script, backup, package)")
+var listFilesInputSchema = z22.object({
+  routerId,
+  name: z22.string().optional().describe("Filter by file name (substring match)"),
+  type: z22.string().optional().describe("Filter by file type (e.g. script, backup, package)")
 }).strict();
 var listFilesTool = {
   name: "list_files",
@@ -4803,14 +4691,13 @@ var listFilesTool = {
         structuredContent: { routerId: context.routerId, files, total: files.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_files" });
+      throw toolError(err, context, "list_files");
     }
   }
 };
-var getFileContentInputSchema = z21.object({
-  routerId: z21.string().describe("Target router identifier from the router registry"),
-  name: z21.string().describe("Exact file name on the router (e.g. flash/script.rsc)")
+var getFileContentInputSchema = z22.object({
+  routerId,
+  name: z22.string().describe("Exact file name on the router (e.g. flash/script.rsc)")
 }).strict();
 var getFileContentTool = {
   name: "get_file_content",
@@ -4854,21 +4741,20 @@ ${contents}`,
         structuredContent: { routerId: context.routerId, name: parsed.name, contents }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "get_file_content" });
+      throw toolError(err, context, "get_file_content");
     }
   }
 };
-var uploadFileInputSchema = z21.object({
-  routerId: z21.string().describe("Target router identifier from the router registry"),
-  name: z21.string().describe("Target filename on the router (e.g. flash/my-script.rsc)"),
-  content: z21.string().describe("File content to upload (text)"),
-  dryRun: z21.boolean().default(false).describe("Validate FTP connectivity without writing the file")
+var uploadFileInputSchema = z22.object({
+  routerId,
+  name: z22.string().describe("Target filename on the router (e.g. flash/my-script.rsc)"),
+  content: z22.string().describe("File content to upload (text)"),
+  dryRun: z22.boolean().default(false).describe("Validate FTP connectivity without writing the file")
 }).strict();
 var uploadFileTool = {
   name: "upload_file",
   title: "Upload File",
-  description: "Upload a text file to a MikroTik router via FTP using the router's credentials. Overwrites any existing file with the same name. Requires FTP permission on the router user \u2014 see config/routers.example.yaml for setup instructions. Supports dry-run (tests FTP connectivity only).",
+  description: "Upload a text file to a router via FTP using the router's credentials, overwriting any existing file of the same name. Requires FTP permission on the router user (see config/routers.example.yaml). Dry-run tests FTP connectivity only.",
   inputSchema: uploadFileInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -4895,7 +4781,6 @@ var uploadFileTool = {
         structuredContent: { action: "uploaded", name: parsed.name, routerId: context.routerId }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
       if (err instanceof Error && err.code === "ECONNREFUSED") {
         throw new MikroMCPError({
           category: "CONFIGURATION" /* CONFIGURATION */,
@@ -4908,14 +4793,14 @@ var uploadFileTool = {
           }
         });
       }
-      throw enrichError(err, { routerId: context.routerId, tool: "upload_file" });
+      throw toolError(err, context, "upload_file");
     }
   }
 };
-var deleteFileInputSchema = z21.object({
-  routerId: z21.string().describe("Target router identifier from the router registry"),
-  name: z21.string().describe("Exact file name on the router (e.g. flash/backup.backup)"),
-  dryRun: z21.boolean().default(false).describe("Preview deletion without removing the file")
+var deleteFileInputSchema = z22.object({
+  routerId,
+  name: z22.string().describe("Exact file name on the router (e.g. flash/backup.backup)"),
+  dryRun: z22.boolean().default(false).describe("Preview deletion without removing the file")
 }).strict();
 var deleteFileTool = {
   name: "delete_file",
@@ -4966,8 +4851,7 @@ var deleteFileTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "delete_file" });
+      throw toolError(err, context, "delete_file");
     }
   }
 };
@@ -4979,11 +4863,11 @@ var filesTools = [
 ];
 
 // src/domain/tools/container-tools.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var log21 = createLogger("container-tools");
 var CONTAINER_PATH = "container";
-var listContainersInputSchema = z22.object({
-  routerId: z22.string().describe("Target router identifier from the router registry")
+var listContainersInputSchema = z23.object({
+  routerId
 }).strict();
 var listContainersTool = {
   name: "list_containers",
@@ -5009,28 +4893,27 @@ var listContainersTool = {
         structuredContent: { routerId: context.routerId, containers, total: containers.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_containers" });
+      throw toolError(err, context, "list_containers");
     }
   }
 };
-var manageContainerInputSchema = z22.object({
-  routerId: z22.string().describe("Target router identifier from the router registry"),
-  action: z22.enum(["create", "start", "stop", "remove"]).describe("Action to perform"),
-  name: z22.string().describe("Container name \u2014 idempotency key"),
-  remoteImage: z22.string().optional().describe("Docker image to pull (required on create, e.g. alpine:latest)"),
-  interface: z22.string().optional().describe(
+var manageContainerInputSchema = z23.object({
+  routerId,
+  action: z23.enum(["create", "start", "stop", "remove"]).describe("Action to perform"),
+  name: z23.string().describe("Container name \u2014 idempotency key"),
+  remoteImage: z23.string().optional().describe("Docker image to pull (required on create, e.g. alpine:latest)"),
+  interface: z23.string().optional().describe(
     "veth interface name to attach the container to (required on create \u2014 must be pre-configured in RouterOS)"
   ),
-  rootDir: z22.string().optional().describe("Root directory for container files"),
-  envlist: z22.string().optional().describe("RouterOS environment list name for container env vars"),
-  comment: z22.string().optional().describe("Optional comment"),
-  dryRun: z22.boolean().default(false).describe("Preview changes without applying")
+  rootDir: z23.string().optional().describe("Root directory for container files"),
+  envlist: z23.string().optional().describe("RouterOS environment list name for container env vars"),
+  comment: z23.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageContainerTool = {
   name: "manage_container",
   title: "Manage Container",
-  description: "Create, start, stop, or remove a RouterOS container. create requires a pre-configured veth interface. start/stop are no-ops if the container is already in the target state. remove throws NOT_FOUND if the container does not exist. Supports dry-run.",
+  description: "Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.",
   inputSchema: manageContainerInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -5194,15 +5077,14 @@ var manageContainerTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_container" });
+      throw toolError(err, context, "manage_container");
     }
   }
 };
 var containerTools = [listContainersTool, manageContainerTool];
 
 // src/domain/tools/change-management-tools.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 import { readFileSync } from "fs";
 
 // src/domain/snapshot/snapshot-engine.ts
@@ -5215,16 +5097,16 @@ function pathToSlug(rosPath) {
 function timestampPrefix() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 15);
 }
-async function takeSnapshot(client, routerId, path, snapshotDir) {
+async function takeSnapshot(client, routerId2, path, snapshotDir) {
   const records = await client.get(path, {});
   const id = `${timestampPrefix()}-${pathToSlug(path)}-${nanoid(6)}`;
-  const dir = join2(snapshotDir, routerId);
+  const dir = join2(snapshotDir, routerId2);
   const filePath = join2(dir, `${id}.json`);
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   await mkdir(dir, { recursive: true });
-  const stored = { id, routerId, path, ts, records };
+  const stored = { id, routerId: routerId2, path, ts, records };
   await writeFile(filePath, JSON.stringify(stored, null, 2));
-  return { id, routerId, path, ts, filePath, recordCount: records.length };
+  return { id, routerId: routerId2, path, ts, filePath, recordCount: records.length };
 }
 async function loadSnapshot(filePath) {
   return JSON.parse(await readFile(filePath, "utf-8"));
@@ -5339,15 +5221,20 @@ var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
   "apikey",
   "confirmationsecret"
 ]);
+function redactValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactValue);
+  }
+  if (value !== null && typeof value === "object") {
+    return redactParams(value);
+  }
+  return value;
+}
 function redactParams(params) {
   const out = {};
   for (const [key2, value] of Object.entries(params)) {
     if (SENSITIVE_KEYS.has(key2.toLowerCase())) continue;
-    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      out[key2] = redactParams(value);
-    } else {
-      out[key2] = value;
-    }
+    out[key2] = redactValue(value);
   }
   return out;
 }
@@ -5398,23 +5285,23 @@ function recordOutcome(args) {
 
 // src/domain/tools/change-management-tools.ts
 var log24 = createLogger("change-management");
-var stepSchema = z23.object({
-  tool: z23.string().min(1).describe("Name of the MikroMCP tool to invoke"),
-  params: z23.record(z23.unknown()).describe("Tool parameters (dryRun is injected automatically)")
+var stepSchema = z24.object({
+  tool: z24.string().min(1).describe("Name of the MikroMCP tool to invoke"),
+  params: z24.record(z24.unknown()).describe("Tool parameters (dryRun is injected automatically)")
 }).strict();
-var planChangesInputSchema = z23.object({
-  routerId: z23.string().describe("Target router identifier"),
-  steps: z23.array(stepSchema).min(1).max(10).describe("Ordered list of write operations to preview (up to 10)")
+var planChangesInputSchema = z24.object({
+  routerId,
+  steps: z24.array(stepSchema).min(1).max(10).describe("Ordered list of write operations to preview (up to 10)")
 }).strict();
-var applyPlanInputSchema = z23.object({
-  routerId: z23.string().describe("Target router identifier"),
-  steps: z23.array(stepSchema).min(1).max(10).describe("Ordered list of write operations to apply in sequence"),
-  confirmationToken: z23.string().optional()
+var applyPlanInputSchema = z24.object({
+  routerId,
+  steps: z24.array(stepSchema).min(1).max(10).describe("Ordered list of write operations to apply in sequence"),
+  confirmationToken: z24.string().optional()
 }).strict();
-var rollbackChangeInputSchema = z23.object({
-  routerId: z23.string().describe("Target router identifier"),
-  journalId: z23.string().describe("Journal entry ID from write-journal.ndjson to roll back"),
-  dryRun: z23.boolean().default(false).describe("Preview the restore plan without applying changes")
+var rollbackChangeInputSchema = z24.object({
+  routerId,
+  journalId: z24.string().describe("Journal entry ID from write-journal.ndjson to roll back"),
+  dryRun: z24.boolean().default(false).describe("Preview the restore plan without applying changes")
 }).strict();
 function createChangeManagementTools(baseTools2) {
   const toolMap = new Map(baseTools2.map((t) => [t.name, t]));
@@ -5436,7 +5323,7 @@ function createChangeManagementTools(baseTools2) {
   const planChangesTool = {
     name: "plan_changes",
     title: "Plan Changes",
-    description: "Preview a sequence of write operations without applying them. Each step is run with dryRun=true against the live router state. Returns the current state of affected RouterOS paths plus the predicted action for each step. Use apply_plan to execute the same steps for real.",
+    description: "Preview a sequence of write operations: each step runs with dryRun=true against live state, returning affected paths and the predicted action per step. Use apply_plan to execute the same steps for real.",
     inputSchema: planChangesInputSchema,
     annotations: {
       readOnlyHint: false,
@@ -5489,7 +5376,7 @@ function createChangeManagementTools(baseTools2) {
   const applyPlanTool = {
     name: "apply_plan",
     title: "Apply Plan",
-    description: "Execute a sequence of write operations in order. Stops on the first failure. Each step is snapshotted and journaled individually. Requires a confirmationToken for non-admin identities (same two-step flow as other destructive tools). Use rollback_change with any resulting journal IDs to undo individual steps.",
+    description: "Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.",
     inputSchema: applyPlanInputSchema,
     snapshotPaths: [],
     annotations: {
@@ -5586,7 +5473,7 @@ function createChangeManagementTools(baseTools2) {
   const rollbackChangeTool = {
     name: "rollback_change",
     title: "Rollback Change",
-    description: "Restore the RouterOS state to what it was before a write, identified by its journal ID. Reads the before-snapshot from disk, computes the diff against live state, and applies the reverse diff. Use dryRun=true to preview the restore plan without applying. Requires MIKROMCP_DATA_DIR (or defaults to data/) to be configured.",
+    description: "Restore RouterOS state to before a write, identified by its journal ID: reads the before-snapshot, diffs against live state, and applies the reverse. Use dryRun=true to preview the restore plan. Requires MIKROMCP_DATA_DIR (defaults to data/).",
     inputSchema: rollbackChangeInputSchema,
     annotations: {
       readOnlyHint: false,
@@ -5637,12 +5524,12 @@ function createChangeManagementTools(baseTools2) {
 }
 
 // src/domain/tools/ipsec-tools.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var log25 = createLogger("ipsec-tools");
-var listIpsecPeersInputSchema = z24.object({
-  routerId: z24.string().describe("Target router identifier from the router registry"),
-  address: z24.string().optional().describe("Filter by remote address (substring match)"),
-  limit: z24.number().int().min(1).max(500).default(100).describe("Maximum number of peers to return")
+var listIpsecPeersInputSchema = z25.object({
+  routerId,
+  address: z25.string().optional().describe("Filter by remote address (substring match)"),
+  limit
 }).strict();
 var listIpsecPeersTool = {
   name: "list_ipsec_peers",
@@ -5677,15 +5564,15 @@ var listIpsecPeersTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ipsec_peers" });
+      throw toolError(err, context, "list_ipsec_peers");
     }
   }
 };
-var listIpsecPoliciesInputSchema = z24.object({
-  routerId: z24.string().describe("Target router identifier from the router registry"),
-  srcAddress: z24.string().optional().describe("Filter by source address (substring match)"),
-  dstAddress: z24.string().optional().describe("Filter by destination address (substring match)"),
-  limit: z24.number().int().min(1).max(500).default(100).describe("Maximum number of policies to return")
+var listIpsecPoliciesInputSchema = z25.object({
+  routerId,
+  srcAddress: z25.string().optional().describe("Filter by source address (substring match)"),
+  dstAddress: z25.string().optional().describe("Filter by destination address (substring match)"),
+  limit
 }).strict();
 var listIpsecPoliciesTool = {
   name: "list_ipsec_policies",
@@ -5722,20 +5609,20 @@ var listIpsecPoliciesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ipsec_policies" });
+      throw toolError(err, context, "list_ipsec_policies");
     }
   }
 };
-var manageIpsecPeerInputSchema = z24.object({
-  routerId: z24.string().describe("Target router identifier from the router registry"),
-  action: z24.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z24.string().describe("Peer name \u2014 idempotency key"),
-  address: z24.string().optional().describe("Remote gateway address (required for add)"),
-  localAddress: z24.string().optional().describe("Local address"),
-  exchange: z24.enum(["ike1", "ike2"]).default("ike2").describe("IKE exchange mode"),
-  profile: z24.string().optional().describe("IKE profile name"),
-  comment: z24.string().optional().describe("Optional comment"),
-  dryRun: z24.boolean().default(false).describe("Preview changes without applying")
+var manageIpsecPeerInputSchema = z25.object({
+  routerId,
+  action: z25.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z25.string().describe("Peer name \u2014 idempotency key"),
+  address: z25.string().optional().describe("Remote gateway address (required for add)"),
+  localAddress: z25.string().optional().describe("Local address"),
+  exchange: z25.enum(["ike1", "ike2"]).default("ike2").describe("IKE exchange mode"),
+  profile: z25.string().optional().describe("IKE profile name"),
+  comment: z25.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageIpsecPeerTool = {
   name: "manage_ipsec_peer",
@@ -5885,22 +5772,21 @@ var manageIpsecPeerTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ipsec_peer" });
-    }
-  }
-};
-var manageIpsecPolicyInputSchema = z24.object({
-  routerId: z24.string().describe("Target router identifier from the router registry"),
-  action: z24.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  srcAddress: z24.string().describe("Source CIDR \u2014 part of composite idempotency key"),
-  dstAddress: z24.string().describe("Destination CIDR \u2014 part of composite idempotency key"),
-  tunnel: z24.boolean().default(false).describe("Tunnel mode \u2014 part of composite idempotency key"),
-  ipsecAction: z24.enum(["encrypt", "discard", "none"]).optional().describe("IPSec action (required for add)"),
-  level: z24.enum(["require", "use", "unique"]).default("require").describe("SA level"),
-  saSourceAddress: z24.string().optional().describe("SA source IP for tunnel mode"),
-  saDstAddress: z24.string().optional().describe("SA destination IP for tunnel mode"),
-  dryRun: z24.boolean().default(false).describe("Preview changes without applying")
+      throw toolError(err, context, "manage_ipsec_peer");
+    }
+  }
+};
+var manageIpsecPolicyInputSchema = z25.object({
+  routerId,
+  action: z25.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  srcAddress: z25.string().describe("Source CIDR \u2014 part of composite idempotency key"),
+  dstAddress: z25.string().describe("Destination CIDR \u2014 part of composite idempotency key"),
+  tunnel: z25.boolean().default(false).describe("Tunnel mode \u2014 part of composite idempotency key"),
+  ipsecAction: z25.enum(["encrypt", "discard", "none"]).optional().describe("IPSec action (required for add)"),
+  level: z25.enum(["require", "use", "unique"]).default("require").describe("SA level"),
+  saSourceAddress: z25.string().optional().describe("SA source IP for tunnel mode"),
+  saDstAddress: z25.string().optional().describe("SA destination IP for tunnel mode"),
+  dryRun
 }).strict();
 var manageIpsecPolicyTool = {
   name: "manage_ipsec_policy",
@@ -6037,8 +5923,7 @@ var manageIpsecPolicyTool = {
         structuredContent: { action: resultAction, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ipsec_policy" });
+      throw toolError(err, context, "manage_ipsec_policy");
     }
   }
 };
@@ -6050,13 +5935,13 @@ var ipsecTools = [
 ];
 
 // src/domain/tools/certificate-tools.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var log26 = createLogger("certificate-tools");
-var listCertificatesInputSchema = z25.object({
-  routerId: z25.string().describe("Target router identifier from the router registry"),
-  name: z25.string().optional().describe("Filter by certificate name (substring match)"),
-  expired: z25.boolean().optional().describe("Filter by expiry status; omit to return all"),
-  limit: z25.number().int().min(1).max(500).default(100).describe("Maximum number of certificates to return")
+var listCertificatesInputSchema = z26.object({
+  routerId,
+  name: z26.string().optional().describe("Filter by certificate name (substring match)"),
+  expired: z26.boolean().optional().describe("Filter by expiry status; omit to return all"),
+  limit
 }).strict();
 var listCertificatesTool = {
   name: "list_certificates",
@@ -6098,15 +5983,15 @@ var listCertificatesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_certificates" });
+      throw toolError(err, context, "list_certificates");
     }
   }
 };
-var manageCertificateInputSchema = z25.object({
-  routerId: z25.string().describe("Target router identifier from the router registry"),
-  action: z25.enum(["remove", "trust", "untrust"]).describe("Action to perform"),
-  name: z25.string().describe("Certificate name \u2014 idempotency key"),
-  dryRun: z25.boolean().default(false).describe("Preview changes without applying")
+var manageCertificateInputSchema = z26.object({
+  routerId,
+  action: z26.enum(["remove", "trust", "untrust"]).describe("Action to perform"),
+  name: z26.string().describe("Certificate name \u2014 idempotency key"),
+  dryRun
 }).strict();
 var manageCertificateTool = {
   name: "manage_certificate",
@@ -6203,20 +6088,19 @@ var manageCertificateTool = {
         structuredContent: { action: "untrusted", name: parsed.name }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_certificate" });
+      throw toolError(err, context, "manage_certificate");
     }
   }
 };
 var certificateTools = [listCertificatesTool, manageCertificateTool];
 
 // src/domain/tools/user-tools.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var log27 = createLogger("user-tools");
-var listUsersInputSchema = z26.object({
-  routerId: z26.string().describe("Target router identifier from the router registry"),
-  group: z26.string().optional().describe("Filter by group name (exact match)"),
-  limit: z26.number().int().min(1).max(500).default(100).describe("Maximum number of users to return")
+var listUsersInputSchema = z27.object({
+  routerId,
+  group: z27.string().optional().describe("Filter by group name (exact match)"),
+  limit
 }).strict();
 var listUsersTool = {
   name: "list_users",
@@ -6258,19 +6142,19 @@ var listUsersTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_users" });
+      throw toolError(err, context, "list_users");
     }
   }
 };
-var manageUserInputSchema = z26.object({
-  routerId: z26.string().describe("Target router identifier from the router registry"),
-  action: z26.enum(["add", "remove", "enable", "disable", "set-password"]).describe("Action to perform"),
-  name: z26.string().describe("Username \u2014 idempotency key"),
-  group: z26.string().optional().describe("Group name (required for add; e.g. 'read', 'write', 'full')"),
-  password: z26.string().optional().describe("Password (required for add and set-password)"),
-  address: z26.string().optional().describe("Allowed source address or range"),
-  comment: z26.string().optional().describe("Optional comment"),
-  dryRun: z26.boolean().default(false).describe("Preview changes without applying")
+var manageUserInputSchema = z27.object({
+  routerId,
+  action: z27.enum(["add", "remove", "enable", "disable", "set-password"]).describe("Action to perform"),
+  name: z27.string().describe("Username \u2014 idempotency key"),
+  group: z27.string().optional().describe("Group name (required for add; e.g. 'read', 'write', 'full')"),
+  password: z27.string().optional().describe("Password (required for add and set-password)"),
+  address: z27.string().optional().describe("Allowed source address or range"),
+  comment: z27.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageUserTool = {
   name: "manage_user",
@@ -6490,19 +6374,18 @@ var manageUserTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_user" });
+      throw toolError(err, context, "manage_user");
     }
   }
 };
 var userTools = [listUsersTool, manageUserTool];
 
 // src/domain/tools/user-group-tools.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var log28 = createLogger("user-group-tools");
-var listUserGroupsInputSchema = z27.object({
-  routerId: z27.string().describe("Target router identifier from the router registry"),
-  limit: z27.number().int().min(1).max(500).default(100).describe("Maximum number of groups to return")
+var listUserGroupsInputSchema = z28.object({
+  routerId,
+  limit
 }).strict();
 var listUserGroupsTool = {
   name: "list_user_groups",
@@ -6534,17 +6417,17 @@ var listUserGroupsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_user_groups" });
+      throw toolError(err, context, "list_user_groups");
     }
   }
 };
-var manageUserGroupInputSchema = z27.object({
-  routerId: z27.string().describe("Target router identifier from the router registry"),
-  action: z27.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z27.string().describe("Group name \u2014 idempotency key"),
-  policy: z27.string().optional().describe("Comma-separated policy list (e.g. 'read,write,ftp')"),
-  skin: z27.string().optional().describe("Optional skin name for the group"),
-  dryRun: z27.boolean().default(false).describe("Preview changes without applying")
+var manageUserGroupInputSchema = z28.object({
+  routerId,
+  action: z28.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z28.string().describe("Group name \u2014 idempotency key"),
+  policy: z28.string().optional().describe("Comma-separated policy list (e.g. 'read,write,ftp')"),
+  skin: z28.string().optional().describe("Optional skin name for the group"),
+  dryRun
 }).strict();
 var manageUserGroupTool = {
   name: "manage_user_group",
@@ -6700,21 +6583,20 @@ var manageUserGroupTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_user_group" });
+      throw toolError(err, context, "manage_user_group");
     }
   }
 };
 var userGroupTools = [listUserGroupsTool, manageUserGroupTool];
 
 // src/domain/tools/dhcp-server-tools.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var log29 = createLogger("dhcp-server-tools");
-var listDhcpServersInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  interface: z28.string().optional().describe("Filter by interface name (exact match)"),
-  limit: z28.number().int().min(1).max(500).default(100).describe("Maximum number of DHCP servers to return"),
-  offset: z28.number().int().min(0).default(0).describe("Offset for pagination")
+var listDhcpServersInputSchema = z29.object({
+  routerId,
+  interface: z29.string().optional().describe("Filter by interface name (exact match)"),
+  limit,
+  offset
 }).strict();
 var listDhcpServersTool = {
   name: "list_dhcp_servers",
@@ -6736,9 +6618,7 @@ var listDhcpServersTool = {
         offset: void 0
       });
       let filtered = parsed.interface ? allServers.filter((s) => s.interface === parsed.interface) : allServers;
-      const total = filtered.length;
-      const servers = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
+      const { items: servers, total, hasMore } = paginate(filtered, parsed.offset, parsed.limit);
       return {
         content: `DHCP servers on ${context.routerId}: ${total} total, showing ${servers.length} (offset ${parsed.offset})`,
         structuredContent: {
@@ -6751,19 +6631,19 @@ var listDhcpServersTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_servers" });
+      throw toolError(err, context, "list_dhcp_servers");
     }
   }
 };
-var manageDhcpServerInputSchema = z28.object({
-  routerId: z28.string().describe("Target router identifier from the router registry"),
-  action: z28.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z28.string().describe("Server name \u2014 idempotency key"),
-  interface: z28.string().optional().describe("Interface to serve DHCP on (required for add)"),
-  addressPool: z28.string().optional().describe("IP pool name (required for add)"),
-  leaseTime: z28.string().optional().describe("Lease duration (e.g. '1d', '12h')"),
-  comment: z28.string().optional().describe("Optional comment"),
-  dryRun: z28.boolean().default(false).describe("Preview changes without applying")
+var manageDhcpServerInputSchema = z29.object({
+  routerId,
+  action: z29.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z29.string().describe("Server name \u2014 idempotency key"),
+  interface: z29.string().optional().describe("Interface to serve DHCP on (required for add)"),
+  addressPool: z29.string().optional().describe("IP pool name (required for add)"),
+  leaseTime: z29.string().optional().describe("Lease duration (e.g. '1d', '12h')"),
+  comment: z29.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageDhcpServerTool = {
   name: "manage_dhcp_server",
@@ -6933,21 +6813,20 @@ var manageDhcpServerTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_server" });
+      throw toolError(err, context, "manage_dhcp_server");
     }
   }
 };
 var dhcpServerTools = [listDhcpServersTool, manageDhcpServerTool];
 
 // src/domain/tools/ip-pool-tools.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 var log30 = createLogger("ip-pool-tools");
-var listIpPoolsInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  name: z29.string().optional().describe("Filter by pool name (substring match)"),
-  limit: z29.number().int().min(1).max(500).default(100).describe("Maximum number of pools to return"),
-  offset: z29.number().int().min(0).default(0).describe("Offset for pagination")
+var listIpPoolsInputSchema = z30.object({
+  routerId,
+  name: z30.string().optional().describe("Filter by pool name (substring match)"),
+  limit,
+  offset
 }).strict();
 var listIpPoolsTool = {
   name: "list_ip_pools",
@@ -6972,9 +6851,7 @@ var listIpPoolsTool = {
       if (parsed.name) {
         filtered = filtered.filter((p) => (p.name ?? "").includes(parsed.name));
       }
-      const total = filtered.length;
-      const pools = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
+      const { items: pools, total, hasMore } = paginate(filtered, parsed.offset, parsed.limit);
       return {
         content: `IP pools on ${context.routerId}: ${total} total, showing ${pools.length} (offset ${parsed.offset})`,
         structuredContent: {
@@ -6987,17 +6864,17 @@ var listIpPoolsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ip_pools" });
+      throw toolError(err, context, "list_ip_pools");
     }
   }
 };
-var manageIpPoolInputSchema = z29.object({
-  routerId: z29.string().describe("Target router identifier from the router registry"),
-  action: z29.enum(["add", "remove"]).describe("Action to perform"),
-  name: z29.string().describe("Pool name \u2014 idempotency key"),
-  ranges: z29.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
-  nextPool: z29.string().optional().describe("Next pool name for overflow"),
-  dryRun: z29.boolean().default(false).describe("Preview changes without applying")
+var manageIpPoolInputSchema = z30.object({
+  routerId,
+  action: z30.enum(["add", "remove"]).describe("Action to perform"),
+  name: z30.string().describe("Pool name \u2014 idempotency key"),
+  ranges: z30.string().optional().describe("IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)"),
+  nextPool: z30.string().optional().describe("Next pool name for overflow"),
+  dryRun
 }).strict();
 var manageIpPoolTool = {
   name: "manage_ip_pool",
@@ -7091,20 +6968,19 @@ var manageIpPoolTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ip_pool" });
+      throw toolError(err, context, "manage_ip_pool");
     }
   }
 };
 var ipPoolTools = [listIpPoolsTool, manageIpPoolTool];
 
 // src/domain/tools/queue-tools.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var log31 = createLogger("queue-tools");
-var listQueuesInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  target: z30.string().optional().describe("Filter by target address (substring match)"),
-  limit: z30.number().int().min(1).max(500).default(100).describe("Maximum number of queues to return")
+var listQueuesInputSchema = z31.object({
+  routerId,
+  target: z31.string().optional().describe("Filter by target address (substring match)"),
+  limit
 }).strict();
 var listQueuesTool = {
   name: "list_queues",
@@ -7139,19 +7015,19 @@ var listQueuesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_queues" });
+      throw toolError(err, context, "list_queues");
     }
   }
 };
-var manageQueueInputSchema = z30.object({
-  routerId: z30.string().describe("Target router identifier from the router registry"),
-  action: z30.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z30.string().describe("Queue name \u2014 idempotency key"),
-  target: z30.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
-  maxLimit: z30.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
-  limitAt: z30.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
-  comment: z30.string().optional().describe("Optional comment"),
-  dryRun: z30.boolean().default(false).describe("Preview changes without applying")
+var manageQueueInputSchema = z31.object({
+  routerId,
+  action: z31.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z31.string().describe("Queue name \u2014 idempotency key"),
+  target: z31.string().optional().describe("Target address (required for add; e.g. '192.168.1.0/24')"),
+  maxLimit: z31.string().optional().describe("Max upload/download limit (e.g. '10M/10M')"),
+  limitAt: z31.string().optional().describe("Guaranteed rate (e.g. '1M/1M')"),
+  comment: z31.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageQueueTool = {
   name: "manage_queue",
@@ -7297,20 +7173,19 @@ var manageQueueTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_queue" });
+      throw toolError(err, context, "manage_queue");
     }
   }
 };
 var queueTools = [listQueuesTool, manageQueueTool];
 
 // src/domain/tools/vrrp-tools.ts
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 var log32 = createLogger("vrrp-tools");
-var listVrrpInstancesInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  interface: z31.string().optional().describe("Filter by master interface name (exact match)"),
-  limit: z31.number().int().min(1).max(500).default(100).describe("Maximum number of instances to return")
+var listVrrpInstancesInputSchema = z32.object({
+  routerId,
+  interface: z32.string().optional().describe("Filter by master interface name (exact match)"),
+  limit
 }).strict();
 var listVrrpInstancesTool = {
   name: "list_vrrp_instances",
@@ -7345,21 +7220,21 @@ var listVrrpInstancesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_vrrp_instances" });
+      throw toolError(err, context, "list_vrrp_instances");
     }
   }
 };
-var manageVrrpInstanceInputSchema = z31.object({
-  routerId: z31.string().describe("Target router identifier from the router registry"),
-  action: z31.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z31.string().describe("VRRP interface name \u2014 idempotency key"),
-  interface: z31.string().optional().describe("Master interface (required for add)"),
-  vrid: z31.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
-  priority: z31.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
-  interval: z31.number().int().min(1).optional().describe("Advertisement interval in seconds"),
-  version: z31.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
-  comment: z31.string().optional().describe("Optional comment"),
-  dryRun: z31.boolean().default(false).describe("Preview changes without applying")
+var manageVrrpInstanceInputSchema = z32.object({
+  routerId,
+  action: z32.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z32.string().describe("VRRP interface name \u2014 idempotency key"),
+  interface: z32.string().optional().describe("Master interface (required for add)"),
+  vrid: z32.number().int().min(1).max(255).optional().describe("Virtual router ID (required for add)"),
+  priority: z32.number().int().min(1).max(254).default(100).describe("Router priority (1\u2013254)"),
+  interval: z32.number().int().min(1).optional().describe("Advertisement interval in seconds"),
+  version: z32.enum(["2", "3"]).default("3").describe("VRRP protocol version"),
+  comment: z32.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageVrrpInstanceTool = {
   name: "manage_vrrp_instance",
@@ -7527,18 +7402,17 @@ var manageVrrpInstanceTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_vrrp_instance" });
+      throw toolError(err, context, "manage_vrrp_instance");
     }
   }
 };
 var vrrpTools = [listVrrpInstancesTool, manageVrrpInstanceTool];
 
 // src/domain/tools/network-services-tools.ts
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 var log33 = createLogger("network-services-tools");
-var getSnmpSettingsInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry")
+var getSnmpSettingsInputSchema = z33.object({
+  routerId
 }).strict();
 var getSnmpSettingsTool = {
   name: "get_snmp_settings",
@@ -7577,13 +7451,12 @@ var getSnmpSettingsTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "get_snmp_settings" });
+      throw toolError(err, context, "get_snmp_settings");
     }
   }
 };
-var getNtpSettingsInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry")
+var getNtpSettingsInputSchema = z33.object({
+  routerId
 }).strict();
 var getNtpSettingsTool = {
   name: "get_ntp_settings",
@@ -7622,16 +7495,15 @@ var getNtpSettingsTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "get_ntp_settings" });
+      throw toolError(err, context, "get_ntp_settings");
     }
   }
 };
-var listNetwatchEntriesInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry"),
-  host: z32.string().optional().describe("Filter by host (substring match)"),
-  status: z32.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
-  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of entries to return")
+var listNetwatchEntriesInputSchema = z33.object({
+  routerId,
+  host: z33.string().optional().describe("Filter by host (substring match)"),
+  status: z33.enum(["up", "down", "unknown"]).optional().describe("Filter by current status"),
+  limit
 }).strict();
 var listNetwatchEntriesTool = {
   name: "list_netwatch_entries",
@@ -7664,19 +7536,19 @@ var listNetwatchEntriesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_netwatch_entries" });
+      throw toolError(err, context, "list_netwatch_entries");
     }
   }
 };
-var manageNetwatchEntryInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry"),
-  action: z32.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  host: z32.string().describe("Host to monitor \u2014 idempotency key"),
-  port: z32.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
-  interval: z32.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
-  timeout: z32.string().optional().describe("Probe timeout (e.g. '500ms')"),
-  comment: z32.string().optional().describe("Optional comment"),
-  dryRun: z32.boolean().default(false).describe("Preview changes without applying")
+var manageNetwatchEntryInputSchema = z33.object({
+  routerId,
+  action: z33.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  host: z33.string().describe("Host to monitor \u2014 idempotency key"),
+  port: z33.number().int().min(1).max(65535).optional().describe("TCP port (optional; ICMP if omitted)"),
+  interval: z33.string().optional().describe("Check interval (e.g. '1m'; default '1m')"),
+  timeout: z33.string().optional().describe("Probe timeout (e.g. '500ms')"),
+  comment: z33.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageNetwatchEntryTool = {
   name: "manage_netwatch_entry",
@@ -7819,15 +7691,14 @@ var manageNetwatchEntryTool = {
         structuredContent: { action: resultAction, host: parsed.host, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_netwatch_entry" });
+      throw toolError(err, context, "manage_netwatch_entry");
     }
   }
 };
-var listNeighborsInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry"),
-  interface: z32.string().optional().describe("Filter by interface name (substring match)"),
-  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of neighbors to return")
+var listNeighborsInputSchema = z33.object({
+  routerId,
+  interface: z33.string().optional().describe("Filter by interface name (substring match)"),
+  limit
 }).strict();
 var listNeighborsTool = {
   name: "list_neighbors",
@@ -7862,16 +7733,16 @@ var listNeighborsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_neighbors" });
+      throw toolError(err, context, "list_neighbors");
     }
   }
 };
-var listArpEntriesInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry"),
-  interface: z32.string().optional().describe("Filter by interface (substring match)"),
-  address: z32.string().optional().describe("Filter by IP address (substring match)"),
-  macAddress: z32.string().optional().describe("Filter by MAC address (substring match)"),
-  limit: z32.number().int().min(1).max(500).default(100).describe("Maximum number of ARP entries to return")
+var listArpEntriesInputSchema = z33.object({
+  routerId,
+  interface: z33.string().optional().describe("Filter by interface (substring match)"),
+  address: z33.string().optional().describe("Filter by IP address (substring match)"),
+  macAddress: z33.string().optional().describe("Filter by MAC address (substring match)"),
+  limit
 }).strict();
 var listArpEntriesTool = {
   name: "list_arp_entries",
@@ -7906,17 +7777,17 @@ var listArpEntriesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_arp_entries" });
+      throw toolError(err, context, "list_arp_entries");
     }
   }
 };
-var manageNtpClientInputSchema = z32.object({
-  routerId: z32.string().describe("Target router identifier from the router registry"),
-  enabled: z32.boolean().optional().describe("Enable or disable the NTP client"),
-  mode: z32.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client mode"),
-  servers: z32.string().optional().describe("Comma-separated NTP server addresses"),
-  vlanInterface: z32.string().optional().describe("VLAN interface for NTP communication"),
-  dryRun: z32.boolean().default(false).describe("Preview changes without applying")
+var manageNtpClientInputSchema = z33.object({
+  routerId,
+  enabled: z33.boolean().optional().describe("Enable or disable the NTP client"),
+  mode: z33.enum(["unicast", "broadcast", "multicast", "manycast"]).optional().describe("NTP client mode"),
+  servers: z33.string().optional().describe("Comma-separated NTP server addresses"),
+  vlanInterface: z33.string().optional().describe("VLAN interface for NTP communication"),
+  dryRun
 }).strict();
 var manageNtpClientTool = {
   name: "manage_ntp_client",
@@ -7978,7 +7849,7 @@ var manageNtpClientTool = {
         structuredContent: { action: "updated", routerId: context.routerId, diff }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ntp_client" });
+      throw toolError(err, context, "manage_ntp_client");
     }
   }
 };
@@ -7993,22 +7864,22 @@ var networkServicesTools = [
 ];
 
 // src/domain/tools/vlan-tools.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var log34 = createLogger("vlan-tools");
 function sanitizeComment4(comment) {
   if (comment === void 0) return void 0;
   return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
-var manageVlanInputSchema = z33.object({
-  routerId: z33.string().describe("Target router identifier from the router registry"),
-  action: z33.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z33.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
-  vlanId: z33.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
-  parentInterface: z33.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
-  mtu: z33.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
-  disabled: z33.boolean().default(false).describe("Whether to create the VLAN disabled (add only)"),
-  comment: z33.string().max(255).optional().describe("Optional comment (add only)"),
-  dryRun: z33.boolean().default(false).describe("Preview changes without applying")
+var manageVlanInputSchema = z34.object({
+  routerId,
+  action: z34.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  name: z34.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
+  vlanId: z34.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
+  parentInterface: z34.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
+  mtu: z34.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
+  disabled: z34.boolean().default(false).describe("Whether to create the VLAN disabled (add only)"),
+  comment: z34.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun
 }).strict();
 var manageVlanTool = {
   name: "manage_vlan",
@@ -8154,22 +8025,21 @@ var manageVlanTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_vlan" });
+      throw toolError(err, context, "manage_vlan");
     }
   }
 };
 var vlanTools = [manageVlanTool];
 
 // src/domain/tools/dhcp-client-tools.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 var log35 = createLogger("dhcp-client-tools");
-var listDhcpClientsInputSchema = z34.object({
-  routerId: z34.string().describe("Target router identifier from the router registry"),
-  interface: z34.string().optional().describe("Filter by interface name (exact match)"),
-  status: z34.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
-  limit: z34.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z34.number().int().min(0).default(0).describe("Offset for pagination")
+var listDhcpClientsInputSchema = z35.object({
+  routerId,
+  interface: z35.string().optional().describe("Filter by interface name (exact match)"),
+  status: z35.enum(["bound", "searching", "requesting", "init", "all"]).default("all").describe("Filter by DHCP client status"),
+  limit,
+  offset
 }).strict();
 var listDhcpClientsTool = {
   name: "list_dhcp_clients",
@@ -8197,22 +8067,9 @@ var listDhcpClientsTool = {
       if (parsed.status !== "all") {
         filtered = filtered.filter((c) => c.status === parsed.status);
       }
-      const total = filtered.length;
-      const clients = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `DHCP clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`
-      ];
-      for (const c of clients) {
-        const rec = c;
-        const iface = rec.interface ?? "unknown";
-        const status = rec.status ?? "unknown";
-        const address = rec.address ?? rec["active-address"] ?? "-";
-        const isDisabled = rec.disabled === true || rec.disabled === "true";
-        lines.push(`  ${iface}  [${status}]  ${address}${isDisabled ? "  DISABLED" : ""}`);
-      }
+      const { items: clients, total, hasMore } = paginate(filtered, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("DHCP clients", context.routerId, clients.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           clients,
@@ -8223,19 +8080,19 @@ var listDhcpClientsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_dhcp_clients" });
+      throw toolError(err, context, "list_dhcp_clients");
     }
   }
 };
-var manageDhcpClientInputSchema = z34.object({
-  routerId: z34.string().describe("Target router identifier from the router registry"),
-  action: z34.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  interface: z34.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
-  usePeerDns: z34.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
-  usePeerNtp: z34.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
-  addDefaultRoute: z34.boolean().default(true).describe("Add default route from DHCP (add only)"),
-  comment: z34.string().max(255).optional().describe("Optional comment (add only)"),
-  dryRun: z34.boolean().default(false).describe("Preview changes without applying")
+var manageDhcpClientInputSchema = z35.object({
+  routerId,
+  action: z35.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  interface: z35.string().describe("Interface name \u2014 idempotency key (e.g. ether1, ether2)"),
+  usePeerDns: z35.boolean().default(true).describe("Use DNS servers provided by DHCP server (add only)"),
+  usePeerNtp: z35.boolean().default(false).describe("Use NTP servers provided by DHCP server (add only)"),
+  addDefaultRoute: z35.boolean().default(true).describe("Add default route from DHCP (add only)"),
+  comment: z35.string().max(255).optional().describe("Optional comment (add only)"),
+  dryRun
 }).strict();
 var manageDhcpClientTool = {
   name: "manage_dhcp_client",
@@ -8353,21 +8210,20 @@ var manageDhcpClientTool = {
         structuredContent: { action: resultAction, interface: parsed.interface, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_dhcp_client" });
+      throw toolError(err, context, "manage_dhcp_client");
     }
   }
 };
 var dhcpClientTools = [listDhcpClientsTool, manageDhcpClientTool];
 
 // src/domain/tools/ip-service-tools.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 var log36 = createLogger("ip-service-tools");
 var SERVICE_NAMES = ["api", "api-ssl", "ssh", "telnet", "www", "www-ssl", "winbox", "ftp"];
-var listIpServicesInputSchema = z35.object({
-  routerId: z35.string().describe("Target router identifier from the router registry"),
-  name: z35.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
-  enabled: z35.boolean().optional().describe("When true, return only enabled services; when false, only disabled services")
+var listIpServicesInputSchema = z36.object({
+  routerId,
+  name: z36.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  enabled: z36.boolean().optional().describe("When true, return only enabled services; when false, only disabled services")
 }).strict();
 var listIpServicesTool = {
   name: "list_ip_services",
@@ -8398,14 +8254,8 @@ var listIpServicesTool = {
           return parsed.enabled ? !isDisabled : isDisabled;
         });
       }
-      const lines = [`IP services on ${context.routerId}: ${filtered.length} returned`];
-      for (const s of filtered) {
-        const rec = s;
-        const isDisabled = rec.disabled === true || rec.disabled === "true";
-        lines.push(`  ${rec.name}  port:${rec.port ?? "-"}  [${isDisabled ? "DISABLED" : "enabled"}]`);
-      }
       return {
-        content: lines.join("\n"),
+        content: `IP services on ${context.routerId}: ${filtered.length} returned. Full records in structuredContent.`,
         structuredContent: {
           routerId: context.routerId,
           services: filtered,
@@ -8413,17 +8263,17 @@ var listIpServicesTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ip_services" });
+      throw toolError(err, context, "list_ip_services");
     }
   }
 };
-var manageIpServiceInputSchema = z35.object({
-  routerId: z35.string().describe("Target router identifier from the router registry"),
-  action: z35.enum(["enable", "disable"]).describe(
+var manageIpServiceInputSchema = z36.object({
+  routerId,
+  action: z36.enum(["enable", "disable"]).describe(
     "Action to perform \u2014 only enable/disable to prevent accidental lockout from changing ports"
   ),
-  name: z35.enum(SERVICE_NAMES).describe("Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
-  dryRun: z35.boolean().default(false).describe("Preview changes without applying")
+  name: z36.enum(SERVICE_NAMES).describe("Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
+  dryRun
 }).strict();
 var manageIpServiceTool = {
   name: "manage_ip_service",
@@ -8491,23 +8341,22 @@ var manageIpServiceTool = {
         structuredContent: { action: resultAction, name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ip_service" });
+      throw toolError(err, context, "manage_ip_service");
     }
   }
 };
 var ipServiceTools = [listIpServicesTool, manageIpServiceTool];
 
 // src/domain/tools/pppoe-tools.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 var log37 = createLogger("pppoe-tools");
 var PPPOE_PATH = "interface/pppoe-client";
-var listPppoeClientsInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry"),
-  interface: z36.string().optional().describe("Filter by parent interface name (exact match)"),
-  status: z36.enum(["connected", "disconnected", "all"]).default("all").describe("Filter by running status"),
-  limit: z36.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z36.number().int().min(0).default(0).describe("Offset for pagination")
+var listPppoeClientsInputSchema = z37.object({
+  routerId,
+  interface: z37.string().optional().describe("Filter by parent interface name (exact match)"),
+  status: z37.enum(["connected", "disconnected", "all"]).default("all").describe("Filter by running status"),
+  limit,
+  offset
 }).strict();
 function isRunning(record) {
   return record.running === true || record.running === "true";
@@ -8540,21 +8389,9 @@ var listPppoeClientsTool = {
       } else if (parsed.status === "disconnected") {
         filtered = filtered.filter((c) => !isRunning(c));
       }
-      const total = filtered.length;
-      const clients = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
-      const lines = [
-        `PPPoE clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`
-      ];
-      for (const c of clients) {
-        const name = c.name ?? "unknown";
-        const iface = c.interface ?? "unknown";
-        const user = c.user ?? "-";
-        const status = isRunning(c) ? "connected" : "disconnected";
-        lines.push(`  ${name}  [${iface}]  user=${user}  ${status}`);
-      }
+      const { items: clients, total, hasMore } = paginate(filtered, parsed.offset, parsed.limit);
       return {
-        content: lines.join("\n"),
+        content: listSummary("PPPoE clients", context.routerId, clients.length, total, parsed.offset),
         structuredContent: {
           routerId: context.routerId,
           clients,
@@ -8565,26 +8402,26 @@ var listPppoeClientsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_pppoe_clients" });
+      throw toolError(err, context, "list_pppoe_clients");
     }
   }
 };
-var managePppoeClientInputSchema = z36.object({
-  routerId: z36.string().describe("Target router identifier from the router registry"),
-  action: z36.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z36.string().describe("PPPoE client interface name \u2014 idempotency key (e.g. pppoe-wan)"),
-  interface: z36.string().optional().describe("Parent interface (required for add)"),
-  user: z36.string().optional().describe("PPPoE username (required for add)"),
-  password: z36.string().optional().describe("PPPoE password (never logged)"),
-  serviceName: z36.string().optional().describe("PPPoE service name filter (leave empty to match any)"),
-  addDefaultRoute: z36.boolean().optional().describe("Add default route via PPPoE (yes/no)"),
-  dialOnDemand: z36.boolean().optional().describe("Dial on demand instead of always-on (yes/no)"),
-  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
+var managePppoeClientInputSchema = z37.object({
+  routerId,
+  action: z37.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z37.string().describe("PPPoE client interface name \u2014 idempotency key (e.g. pppoe-wan)"),
+  interface: z37.string().optional().describe("Parent interface (required for add)"),
+  user: z37.string().optional().describe("PPPoE username (required for add)"),
+  password: z37.string().optional().describe("PPPoE password (never logged)"),
+  serviceName: z37.string().optional().describe("PPPoE service name filter (leave empty to match any)"),
+  addDefaultRoute: z37.boolean().optional().describe("Add default route via PPPoE (yes/no)"),
+  dialOnDemand: z37.boolean().optional().describe("Dial on demand instead of always-on (yes/no)"),
+  dryRun
 }).strict();
 var managePppoeClientTool = {
   name: "manage_pppoe_client",
   title: "Manage PPPoE Client",
-  description: "Add, update, or remove a PPPoE client interface. Idempotent by name: add returns already_exists if same name+interface+user exists; throws CONFLICT if same name exists with different config. Update builds a diff of changed fields and returns no_change when nothing differs. Password is always written when provided because RouterOS does not expose it in GET.",
+  description: "Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.",
   inputSchema: managePppoeClientInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -8775,22 +8612,21 @@ var managePppoeClientTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_pppoe_client" });
+      throw toolError(err, context, "manage_pppoe_client");
     }
   }
 };
 var pppoeTools = [listPppoeClientsTool, managePppoeClientTool];
 
 // src/domain/tools/ovpn-tools.ts
-import { z as z37 } from "zod";
+import { z as z38 } from "zod";
 var log38 = createLogger("ovpn-tools");
 var OVPN_CLIENT_PATH = "interface/ovpn-client";
 var OVPN_SERVER_PATH = "interface/ovpn-server/server";
-var listOvpnClientsInputSchema = z37.object({
-  routerId: z37.string().describe("Target router identifier from the router registry"),
-  limit: z37.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
-  offset: z37.number().int().min(0).default(0).describe("Offset for pagination")
+var listOvpnClientsInputSchema = z38.object({
+  routerId,
+  limit,
+  offset
 }).strict();
 var listOvpnClientsTool = {
   name: "list_ovpn_clients",
@@ -8811,9 +8647,7 @@ var listOvpnClientsTool = {
         limit: void 0,
         offset: void 0
       });
-      const total = allClients.length;
-      const clients = allClients.slice(parsed.offset, parsed.offset + parsed.limit);
-      const hasMore = parsed.offset + parsed.limit < total;
+      const { items: clients, total, hasMore } = paginate(allClients, parsed.offset, parsed.limit);
       return {
         content: `OpenVPN clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`,
         structuredContent: {
@@ -8826,27 +8660,27 @@ var listOvpnClientsTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ovpn_clients" });
+      throw toolError(err, context, "list_ovpn_clients");
     }
   }
 };
-var manageOvpnClientInputSchema = z37.object({
-  routerId: z37.string().describe("Target router identifier from the router registry"),
-  action: z37.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z37.string().describe("OpenVPN client interface name \u2014 idempotency key"),
-  connectTo: z37.string().optional().describe("Remote server address (required for add)"),
-  port: z37.number().int().min(1).max(65535).optional().describe("Remote port number"),
-  mode: z37.enum(["ip", "ethernet"]).optional().describe("Tunnel mode"),
-  protocol: z37.enum(["tcp-client", "udp"]).optional().describe("Transport protocol"),
-  certificate: z37.string().optional().describe("Client certificate name"),
-  user: z37.string().optional().describe("VPN username"),
-  password: z37.string().optional().describe("VPN password (never logged)"),
-  dryRun: z37.boolean().default(false).describe("Preview changes without applying")
+var manageOvpnClientInputSchema = z38.object({
+  routerId,
+  action: z38.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z38.string().describe("OpenVPN client interface name \u2014 idempotency key"),
+  connectTo: z38.string().optional().describe("Remote server address (required for add)"),
+  port: z38.number().int().min(1).max(65535).optional().describe("Remote port number"),
+  mode: z38.enum(["ip", "ethernet"]).optional().describe("Tunnel mode"),
+  protocol: z38.enum(["tcp-client", "udp"]).optional().describe("Transport protocol"),
+  certificate: z38.string().optional().describe("Client certificate name"),
+  user: z38.string().optional().describe("VPN username"),
+  password: z38.string().optional().describe("VPN password (never logged)"),
+  dryRun
 }).strict();
 var manageOvpnClientTool = {
   name: "manage_ovpn_client",
   title: "Manage OpenVPN Client",
-  description: "Add, update, or remove an OpenVPN client interface. Idempotent by name: add returns already_exists if same name+connectTo exists; throws CONFLICT if same name exists with different connectTo. Update builds a diff of changed fields and returns no_change when nothing differs. Password is always written when provided because RouterOS does not expose it in GET.",
+  description: "Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.",
   inputSchema: manageOvpnClientInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -9013,21 +8847,20 @@ var manageOvpnClientTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_client" });
+      throw toolError(err, context, "manage_ovpn_client");
     }
   }
 };
-var getOvpnServerInputSchema = z37.object({
-  routerId: z37.string().describe("Target router identifier from the router registry")
+var getOvpnServerInputSchema = z38.object({
+  routerId
 }).strict();
-function fetchOvpnServer(allRecords, routerId) {
+function fetchOvpnServer(allRecords, routerId2) {
   if (allRecords.length === 0) {
     throw new MikroMCPError({
       category: "NOT_FOUND" /* NOT_FOUND */,
       code: "OVPN_SERVER_NOT_FOUND",
       message: "OpenVPN server not found. The OpenVPN package may not be installed on this router.",
-      details: { routerId },
+      details: { routerId: routerId2 },
       recoverability: {
         retryable: false,
         suggestedAction: "Install the OpenVPN package via manage_package.",
@@ -9049,39 +8882,38 @@ var getOvpnServerTool = {
     openWorldHint: false
   },
   async handler(params, context) {
-    const parsed = getOvpnServerInputSchema.parse(params);
+    getOvpnServerInputSchema.parse(params);
     log38.info({ routerId: context.routerId }, "Getting OpenVPN server configuration");
     try {
       const records = await context.routerClient.get(OVPN_SERVER_PATH, {
         limit: void 0,
         offset: void 0
       });
-      const server = fetchOvpnServer(records, parsed.routerId);
+      const server = fetchOvpnServer(records, context.routerId);
       return {
         content: `OpenVPN server on ${context.routerId}: enabled=${server.enabled}, port=${server.port}, protocol=${server.protocol}`,
         structuredContent: { routerId: context.routerId, server }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "get_ovpn_server" });
+      throw toolError(err, context, "get_ovpn_server");
     }
   }
 };
-var manageOvpnServerInputSchema = z37.object({
-  routerId: z37.string().describe("Target router identifier from the router registry"),
-  action: z37.enum(["enable", "disable", "set"]).describe("Action to perform"),
-  port: z37.number().int().min(1).max(65535).optional().describe("Listening port (set action only)"),
-  mode: z37.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
-  protocol: z37.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
-  certificate: z37.string().optional().describe("Server certificate name (set action only)"),
-  cipher: z37.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
-  auth: z37.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
-  dryRun: z37.boolean().default(false).describe("Preview changes without applying")
+var manageOvpnServerInputSchema = z38.object({
+  routerId,
+  action: z38.enum(["enable", "disable", "set"]).describe("Action to perform"),
+  port: z38.number().int().min(1).max(65535).optional().describe("Listening port (set action only)"),
+  mode: z38.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
+  protocol: z38.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
+  certificate: z38.string().optional().describe("Server certificate name (set action only)"),
+  cipher: z38.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
+  auth: z38.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
+  dryRun
 }).strict();
 var manageOvpnServerTool = {
   name: "manage_ovpn_server",
   title: "Manage OpenVPN Server",
-  description: "Enable, disable, or configure the OpenVPN server on a MikroTik router. The server is a singleton \u2014 there is only one per router. Throws NOT_FOUND if the OpenVPN package is not installed. For set action, at least one configuration field must be provided.",
+  description: "Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.",
   inputSchema: manageOvpnServerInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -9098,7 +8930,7 @@ var manageOvpnServerTool = {
         limit: void 0,
         offset: void 0
       });
-      const server = fetchOvpnServer(records, parsed.routerId);
+      const server = fetchOvpnServer(records, context.routerId);
       const serverId = server[".id"];
       if (parsed.action === "enable" || parsed.action === "disable") {
         const desiredEnabled = parsed.action === "enable";
@@ -9186,8 +9018,7 @@ var manageOvpnServerTool = {
         structuredContent: { action: "updated", diff }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_server" });
+      throw toolError(err, context, "manage_ovpn_server");
     }
   }
 };
@@ -9199,12 +9030,12 @@ var ovpnTools = [
 ];
 
 // src/domain/tools/ppp-tools.ts
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 var log39 = createLogger("ppp-tools");
-var listPppProfilesInputSchema = z38.object({
-  routerId: z38.string().describe("Target router identifier from the router registry"),
-  name: z38.string().optional().describe("Filter by profile name (exact match)"),
-  limit: z38.number().int().min(1).max(500).default(100).describe("Maximum profiles to return")
+var listPppProfilesInputSchema = z39.object({
+  routerId,
+  name: z39.string().optional().describe("Filter by profile name (exact match)"),
+  limit
 }).strict();
 var listPppProfilesTool = {
   name: "list_ppp_profiles",
@@ -9224,22 +9055,21 @@ var listPppProfilesTool = {
         structuredContent: { routerId: context.routerId, profiles, total: all.length, returned: profiles.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_ppp_profiles" });
+      throw toolError(err, context, "list_ppp_profiles");
     }
   }
 };
-var managePppProfileInputSchema = z38.object({
-  routerId: z38.string().describe("Target router identifier from the router registry"),
-  action: z38.enum(["add", "update", "remove"]).describe("Action to perform"),
-  name: z38.string().describe("Profile name \u2014 idempotency key"),
-  localAddress: z38.string().optional().describe("Local IP assigned to router end of PPP link"),
-  remoteAddress: z38.string().optional().describe("IP or pool name assigned to client"),
-  dnsServer: z38.string().optional().describe("DNS server IP pushed to client"),
-  rateLimit: z38.string().optional().describe("Rate limit string (e.g. '10M/10M')"),
-  sessionTimeout: z38.string().optional().describe("Session timeout duration string (e.g. '1h')"),
-  comment: z38.string().optional().describe("Optional comment"),
-  dryRun: z38.boolean().default(false).describe("Preview changes without applying")
+var managePppProfileInputSchema = z39.object({
+  routerId,
+  action: z39.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z39.string().describe("Profile name \u2014 idempotency key"),
+  localAddress: z39.string().optional().describe("Local IP assigned to router end of PPP link"),
+  remoteAddress: z39.string().optional().describe("IP or pool name assigned to client"),
+  dnsServer: z39.string().optional().describe("DNS server IP pushed to client"),
+  rateLimit: z39.string().optional().describe("Rate limit string (e.g. '10M/10M')"),
+  sessionTimeout: z39.string().optional().describe("Session timeout duration string (e.g. '1h')"),
+  comment: z39.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var managePppProfileTool = {
   name: "manage_ppp_profile",
@@ -9364,18 +9194,17 @@ var managePppProfileTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_ppp_profile" });
+      throw toolError(err, context, "manage_ppp_profile");
     }
   }
 };
 var pppTools = [listPppProfilesTool, managePppProfileTool];
 
 // src/domain/tools/upgrade-tools.ts
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var log40 = createLogger("upgrade-tools");
-var getUpgradeStatusInputSchema = z39.object({
-  routerId: z39.string().describe("Target router identifier from the router registry")
+var getUpgradeStatusInputSchema = z40.object({
+  routerId
 }).strict();
 var getUpgradeStatusTool = {
   name: "get_upgrade_status",
@@ -9415,16 +9244,16 @@ var getUpgradeStatusTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_upgrade_status" });
+      throw toolError(err, context, "get_upgrade_status");
     }
   }
 };
-var manageUpgradeInputSchema = z39.object({
-  routerId: z39.string().describe("Target router identifier from the router registry"),
-  action: z39.enum(["check", "install"]).describe(
+var manageUpgradeInputSchema = z40.object({
+  routerId,
+  action: z40.enum(["check", "install"]).describe(
     "check \u2014 trigger a check for available updates; install \u2014 download and install the latest update (triggers reboot)"
   ),
-  dryRun: z39.boolean().default(false).describe("Preview the action without executing")
+  dryRun: z40.boolean().default(false).describe("Preview the action without executing")
 }).strict();
 var manageUpgradeTool = {
   name: "manage_upgrade",
@@ -9466,20 +9295,20 @@ var manageUpgradeTool = {
         structuredContent: { action: "install_triggered", routerId: parsed.routerId }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_upgrade" });
+      throw toolError(err, context, "manage_upgrade");
     }
   }
 };
 var upgradeTools = [getUpgradeStatusTool, manageUpgradeTool];
 
 // src/domain/tools/backup-tools.ts
-import { z as z40 } from "zod";
+import { z as z41 } from "zod";
 var log41 = createLogger("backup-tools");
-var createBackupInputSchema = z40.object({
-  routerId: z40.string().describe("Target router identifier from the router registry"),
-  name: z40.string().default("backup").describe("Backup file name (without extension)"),
-  password: z40.string().optional().describe("Password to encrypt the backup file"),
-  dryRun: z40.boolean().default(false).describe("Preview the backup without creating it")
+var createBackupInputSchema = z41.object({
+  routerId,
+  name: z41.string().default("backup").describe("Backup file name (without extension)"),
+  password: z41.string().optional().describe("Password to encrypt the backup file"),
+  dryRun: z41.boolean().default(false).describe("Preview the backup without creating it")
 }).strict();
 var createBackupTool = {
   name: "create_backup",
@@ -9517,15 +9346,14 @@ var createBackupTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "create_backup" });
+      throw toolError(err, context, "create_backup");
     }
   }
 };
-var exportConfigInputSchema = z40.object({
-  routerId: z40.string().describe("Target router identifier from the router registry"),
-  compact: z40.boolean().default(false).describe("Export only non-default settings (compact format)"),
-  file: z40.string().optional().describe("Save the export to a file on the router (without extension); omit to return inline")
+var exportConfigInputSchema = z41.object({
+  routerId,
+  compact: z41.boolean().default(false).describe("Export only non-default settings (compact format)"),
+  file: z41.string().optional().describe("Save the export to a file on the router (without extension); omit to return inline")
 }).strict();
 var exportConfigTool = {
   name: "export_config",
@@ -9566,24 +9394,23 @@ ${scriptText}`,
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "export_config" });
+      throw toolError(err, context, "export_config");
     }
   }
 };
 var backupTools = [createBackupTool, exportConfigTool];
 
 // src/domain/tools/log-tools.ts
-import { z as z41 } from "zod";
+import { z as z42 } from "zod";
 var log42 = createLogger("log-tools");
 var LOG_RULES_PATH = "system/logging";
 var LOG_ACTIONS_PATH = "system/logging/action";
-var logActionTypeEnum = z41.enum(["memory", "disk", "remote", "echo", "email"]);
-var listLogRulesInputSchema = z41.object({
-  routerId: z41.string().describe("Target router identifier from the router registry"),
-  topics: z41.string().optional().describe("Filter by topics (substring match)"),
-  logAction: z41.string().optional().describe("Filter by log action target (exact match on action field)"),
-  limit: z41.number().int().min(1).max(500).default(100).describe("Maximum number of rules to return (1-500, default 100)")
+var logActionTypeEnum = z42.enum(["memory", "disk", "remote", "echo", "email"]);
+var listLogRulesInputSchema = z42.object({
+  routerId,
+  topics: z42.string().optional().describe("Filter by topics (substring match)"),
+  logAction: z42.string().optional().describe("Filter by log action target (exact match on action field)"),
+  limit
 }).strict();
 var listLogRulesTool = {
   name: "list_log_rules",
@@ -9622,23 +9449,22 @@ var listLogRulesTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_log_rules" });
+      throw toolError(err, context, "list_log_rules");
     }
   }
 };
-var manageLogRuleInputSchema = z41.object({
-  routerId: z41.string().describe("Target router identifier from the router registry"),
-  action: z41.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  topics: z41.string().describe("Log topics (e.g. firewall, system, info) \u2014 idempotency key"),
-  logAction: z41.string().describe("Log action target name (RouterOS action field) \u2014 idempotency key"),
-  prefix: z41.string().optional().describe("Optional prefix to prepend to log messages"),
-  dryRun: z41.boolean().default(false).describe("Preview changes without applying")
+var manageLogRuleInputSchema = z42.object({
+  routerId,
+  action: z42.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
+  topics: z42.string().describe("Log topics (e.g. firewall, system, info) \u2014 idempotency key"),
+  logAction: z42.string().describe("Log action target name (RouterOS action field) \u2014 idempotency key"),
+  prefix: z42.string().optional().describe("Optional prefix to prepend to log messages"),
+  dryRun
 }).strict();
 var manageLogRuleTool = {
   name: "manage_log_rule",
   title: "Manage Log Rule",
-  description: "Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction pair. add returns already_exists if matching rule found. remove returns not_found gracefully. enable/disable throw NOT_FOUND if rule not found. Supports dry-run.",
+  description: "Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add \u2192 already_exists on match; remove \u2192 not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.",
   inputSchema: manageLogRuleInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -9771,15 +9597,14 @@ var manageLogRuleTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_log_rule" });
+      throw toolError(err, context, "manage_log_rule");
     }
   }
 };
-var listLogActionsInputSchema = z41.object({
-  routerId: z41.string().describe("Target router identifier from the router registry"),
+var listLogActionsInputSchema = z42.object({
+  routerId,
   type: logActionTypeEnum.optional().describe("Filter by action type (exact match): memory, disk, remote, echo, email"),
-  limit: z41.number().int().min(1).max(500).default(100).describe("Maximum number of actions to return (1-500, default 100)")
+  limit
 }).strict();
 var listLogActionsTool = {
   name: "list_log_actions",
@@ -9815,20 +9640,19 @@ var listLogActionsTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_log_actions" });
+      throw toolError(err, context, "list_log_actions");
     }
   }
 };
-var manageLogActionInputSchema = z41.object({
-  routerId: z41.string().describe("Target router identifier from the router registry"),
-  action: z41.enum(["add", "remove"]).describe("Action to perform"),
-  name: z41.string().describe("Log action name \u2014 idempotency key"),
+var manageLogActionInputSchema = z42.object({
+  routerId,
+  action: z42.enum(["add", "remove"]).describe("Action to perform"),
+  name: z42.string().describe("Log action name \u2014 idempotency key"),
   type: logActionTypeEnum.optional().describe("Action type: memory, disk, remote, echo, email (required on add)"),
-  remote: z41.string().optional().describe("Remote syslog server address (for type=remote)"),
-  remotePort: z41.number().int().min(1).max(65535).optional().describe("Remote syslog server port (for type=remote)"),
-  diskFileName: z41.string().optional().describe("Disk log file name without extension (for type=disk)"),
-  dryRun: z41.boolean().default(false).describe("Preview changes without applying")
+  remote: z42.string().optional().describe("Remote syslog server address (for type=remote)"),
+  remotePort: z42.number().int().min(1).max(65535).optional().describe("Remote syslog server port (for type=remote)"),
+  diskFileName: z42.string().optional().describe("Disk log file name without extension (for type=disk)"),
+  dryRun
 }).strict();
 var manageLogActionTool = {
   name: "manage_log_action",
@@ -9944,8 +9768,7 @@ var manageLogActionTool = {
         }
       });
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_log_action" });
+      throw toolError(err, context, "manage_log_action");
     }
   }
 };
@@ -9957,15 +9780,15 @@ var logTools = [
 ];
 
 // src/domain/tools/network-test-tools.ts
-import { z as z42 } from "zod";
+import { z as z43 } from "zod";
 var log43 = createLogger("network-test-tools");
 var BODY_CAP = 65536;
-var bandwidthTestInputSchema = z42.object({
-  routerId: z42.string().describe("Target router identifier from the router registry"),
-  address: z42.string().describe("Remote host running RouterOS btest server"),
-  protocol: z42.enum(["tcp", "udp"]).default("tcp").describe("Test protocol"),
-  direction: z42.enum(["send", "receive", "both"]).default("both").describe("Test direction"),
-  duration: z42.number().int().min(1).max(30).default(5).describe("Test duration in seconds (max 30)")
+var bandwidthTestInputSchema = z43.object({
+  routerId,
+  address: z43.string().describe("Remote host running RouterOS btest server"),
+  protocol: z43.enum(["tcp", "udp"]).default("tcp").describe("Test protocol"),
+  direction: z43.enum(["send", "receive", "both"]).default("both").describe("Test direction"),
+  duration: z43.number().int().min(1).max(30).default(5).describe("Test duration in seconds (max 30)")
 }).strict();
 var bandwidthTestTool = {
   name: "bandwidth_test",
@@ -10000,16 +9823,16 @@ var bandwidthTestTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "bandwidth_test" });
+      throw toolError(err, context, "bandwidth_test");
     }
   }
 };
-var fetchUrlInputSchema = z42.object({
-  routerId: z42.string().describe("Target router identifier from the router registry"),
-  url: z42.string().url().describe("URL to fetch from the router"),
-  method: z42.enum(["GET", "POST"]).default("GET").describe("HTTP method"),
-  httpData: z42.string().optional().describe("Request body for POST"),
-  outputFile: z42.string().optional().describe("Save response body to this router file path instead of returning inline")
+var fetchUrlInputSchema = z43.object({
+  routerId,
+  url: z43.string().url().describe("URL to fetch from the router"),
+  method: z43.enum(["GET", "POST"]).default("GET").describe("HTTP method"),
+  httpData: z43.string().optional().describe("Request body for POST"),
+  outputFile: z43.string().optional().describe("Save response body to this router file path instead of returning inline")
 }).strict();
 var fetchUrlTool = {
   name: "fetch_url",
@@ -10047,16 +9870,16 @@ var fetchUrlTool = {
         structuredContent: { routerId: context.routerId, url: parsed.url, statusCode, body: responseBody }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "fetch_url" });
+      throw toolError(err, context, "fetch_url");
     }
   }
 };
-var listConnectionsInputSchema = z42.object({
-  routerId: z42.string().describe("Target router identifier from the router registry"),
-  srcAddress: z42.string().optional().describe("Filter by source address (substring match)"),
-  dstAddress: z42.string().optional().describe("Filter by destination address (substring match)"),
-  protocol: z42.string().optional().describe("Filter by protocol (exact match, e.g. tcp, udp, icmp)"),
-  limit: z42.number().int().min(1).max(500).default(100).describe("Maximum connections to return")
+var listConnectionsInputSchema = z43.object({
+  routerId,
+  srcAddress: z43.string().optional().describe("Filter by source address (substring match)"),
+  dstAddress: z43.string().optional().describe("Filter by destination address (substring match)"),
+  protocol: z43.string().optional().describe("Filter by protocol (exact match, e.g. tcp, udp, icmp)"),
+  limit
 }).strict();
 var listConnectionsTool = {
   name: "list_connections",
@@ -10079,16 +9902,16 @@ var listConnectionsTool = {
         structuredContent: { routerId: context.routerId, connections, total: all.length, returned: connections.length }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_connections" });
+      throw toolError(err, context, "list_connections");
     }
   }
 };
 var networkTestTools = [bandwidthTestTool, fetchUrlTool, listConnectionsTool];
 
 // src/domain/tools/container-config-tools.ts
-import { z as z43 } from "zod";
+import { z as z44 } from "zod";
 var log44 = createLogger("container-config-tools");
-var getContainerConfigInputSchema = z43.object({ routerId: z43.string().describe("Target router identifier from the router registry") }).strict();
+var getContainerConfigInputSchema = z44.object({ routerId }).strict();
 var getContainerConfigTool = {
   name: "get_container_config",
   title: "Get Container Config",
@@ -10111,16 +9934,16 @@ var getContainerConfigTool = {
         }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "get_container_config" });
+      throw toolError(err, context, "get_container_config");
     }
   }
 };
-var manageContainerConfigInputSchema = z43.object({
-  routerId: z43.string().describe("Target router identifier from the router registry"),
-  registryUrl: z43.string().optional().describe("Container registry URL"),
-  ramHighMb: z43.number().int().min(1).optional().describe("RAM high-water mark in MB"),
-  vethInterface: z43.string().optional().describe("Veth interface name for container networking"),
-  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+var manageContainerConfigInputSchema = z44.object({
+  routerId,
+  registryUrl: z44.string().optional().describe("Container registry URL"),
+  ramHighMb: z44.number().int().min(1).optional().describe("RAM high-water mark in MB"),
+  vethInterface: z44.string().optional().describe("Veth interface name for container networking"),
+  dryRun
 }).strict();
 var manageContainerConfigTool = {
   name: "manage_container_config",
@@ -10172,14 +9995,14 @@ var manageContainerConfigTool = {
         structuredContent: { action: "updated", routerId: context.routerId, diff }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_config" });
+      throw toolError(err, context, "manage_container_config");
     }
   }
 };
-var listContainerEnvsInputSchema = z43.object({
-  routerId: z43.string().describe("Target router identifier from the router registry"),
-  name: z43.string().optional().describe("Filter by container name (exact match)"),
-  limit: z43.number().int().min(1).max(500).default(100).describe("Maximum entries to return")
+var listContainerEnvsInputSchema = z44.object({
+  routerId,
+  name: z44.string().optional().describe("Filter by container name (exact match)"),
+  limit
 }).strict();
 var listContainerEnvsTool = {
   name: "list_container_envs",
@@ -10202,17 +10025,17 @@ var listContainerEnvsTool = {
         structuredContent: { routerId: context.routerId, envs, total: all.length, returned: envs.length }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_container_envs" });
+      throw toolError(err, context, "list_container_envs");
     }
   }
 };
-var manageContainerEnvInputSchema = z43.object({
-  routerId: z43.string().describe("Target router identifier from the router registry"),
-  action: z43.enum(["add", "remove"]).describe("Action to perform"),
-  name: z43.string().describe("Container name"),
-  key: z43.string().describe("Environment variable name \u2014 part of idempotency key"),
-  value: z43.string().optional().describe("Environment variable value (required for add)"),
-  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+var manageContainerEnvInputSchema = z44.object({
+  routerId,
+  action: z44.enum(["add", "remove"]).describe("Action to perform"),
+  name: z44.string().describe("Container name"),
+  key: z44.string().describe("Environment variable name \u2014 part of idempotency key"),
+  value: z44.string().optional().describe("Environment variable value (required for add)"),
+  dryRun
 }).strict();
 var manageContainerEnvTool = {
   name: "manage_container_env",
@@ -10309,15 +10132,14 @@ var manageContainerEnvTool = {
         structuredContent: { action: "removed", name: parsed.name, key: parsed.key }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_env" });
+      throw toolError(err, context, "manage_container_env");
     }
   }
 };
-var listContainerMountsInputSchema = z43.object({
-  routerId: z43.string().describe("Target router identifier from the router registry"),
-  name: z43.string().optional().describe("Filter by mount name (exact match)"),
-  limit: z43.number().int().min(1).max(500).default(100).describe("Maximum entries to return")
+var listContainerMountsInputSchema = z44.object({
+  routerId,
+  name: z44.string().optional().describe("Filter by mount name (exact match)"),
+  limit
 }).strict();
 var listContainerMountsTool = {
   name: "list_container_mounts",
@@ -10340,17 +10162,17 @@ var listContainerMountsTool = {
         structuredContent: { routerId: context.routerId, mounts, total: all.length, returned: mounts.length }
       };
     } catch (err) {
-      throw enrichError(err, { routerId: context.routerId, tool: "list_container_mounts" });
+      throw toolError(err, context, "list_container_mounts");
     }
   }
 };
-var manageContainerMountInputSchema = z43.object({
-  routerId: z43.string().describe("Target router identifier from the router registry"),
-  action: z43.enum(["add", "remove"]).describe("Action to perform"),
-  name: z43.string().describe("Mount name \u2014 idempotency key"),
-  src: z43.string().optional().describe("Host source path (required for add)"),
-  dst: z43.string().optional().describe("Container destination path (required for add)"),
-  dryRun: z43.boolean().default(false).describe("Preview changes without applying")
+var manageContainerMountInputSchema = z44.object({
+  routerId,
+  action: z44.enum(["add", "remove"]).describe("Action to perform"),
+  name: z44.string().describe("Mount name \u2014 idempotency key"),
+  src: z44.string().optional().describe("Host source path (required for add)"),
+  dst: z44.string().optional().describe("Container destination path (required for add)"),
+  dryRun
 }).strict();
 var manageContainerMountTool = {
   name: "manage_container_mount",
@@ -10440,8 +10262,7 @@ var manageContainerMountTool = {
         structuredContent: { action: "removed", name: parsed.name }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_container_mount" });
+      throw toolError(err, context, "manage_container_mount");
     }
   }
 };
@@ -10455,11 +10276,11 @@ var containerConfigTools = [
 ];
 
 // src/domain/tools/interface-list-tools.ts
-import { z as z44 } from "zod";
+import { z as z45 } from "zod";
 var log45 = createLogger("interface-list-tools");
-var listInterfaceListsInputSchema = z44.object({
-  routerId: z44.string().describe("Target router identifier from the router registry"),
-  limit: z44.number().int().min(1).max(500).default(100).describe("Maximum lists to return")
+var listInterfaceListsInputSchema = z45.object({
+  routerId,
+  limit
 }).strict();
 var listInterfaceListsTool = {
   name: "list_interface_lists",
@@ -10481,17 +10302,16 @@ var listInterfaceListsTool = {
         structuredContent: { routerId: context.routerId, lists, total: all.length, returned: lists.length }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "list_interface_lists" });
+      throw toolError(err, context, "list_interface_lists");
     }
   }
 };
-var manageInterfaceListInputSchema = z44.object({
-  routerId: z44.string().describe("Target router identifier from the router registry"),
-  action: z44.enum(["add", "remove"]).describe("Action to perform"),
-  name: z44.string().describe("Interface list name \u2014 idempotency key"),
-  comment: z44.string().optional().describe("Optional comment"),
-  dryRun: z44.boolean().default(false).describe("Preview changes without applying")
+var manageInterfaceListInputSchema = z45.object({
+  routerId,
+  action: z45.enum(["add", "remove"]).describe("Action to perform"),
+  name: z45.string().describe("Interface list name \u2014 idempotency key"),
+  comment: z45.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageInterfaceListTool = {
   name: "manage_interface_list",
@@ -10555,18 +10375,17 @@ var manageInterfaceListTool = {
         structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_interface_list" });
+      throw toolError(err, context, "manage_interface_list");
     }
   }
 };
-var manageInterfaceListMemberInputSchema = z44.object({
-  routerId: z44.string().describe("Target router identifier from the router registry"),
-  action: z44.enum(["add", "remove"]).describe("Action to perform"),
-  list: z44.string().describe("Interface list name \u2014 part of composite idempotency key"),
-  interface: z44.string().describe("Interface name to add/remove \u2014 part of composite idempotency key"),
-  comment: z44.string().optional().describe("Optional comment"),
-  dryRun: z44.boolean().default(false).describe("Preview changes without applying")
+var manageInterfaceListMemberInputSchema = z45.object({
+  routerId,
+  action: z45.enum(["add", "remove"]).describe("Action to perform"),
+  list: z45.string().describe("Interface list name \u2014 part of composite idempotency key"),
+  interface: z45.string().describe("Interface name to add/remove \u2014 part of composite idempotency key"),
+  comment: z45.string().optional().describe("Optional comment"),
+  dryRun
 }).strict();
 var manageInterfaceListMemberTool = {
   name: "manage_interface_list_member",
@@ -10640,8 +10459,7 @@ var manageInterfaceListMemberTool = {
         }
       };
     } catch (err) {
-      if (err instanceof MikroMCPError) throw err;
-      throw enrichError(err, { routerId: context.routerId, tool: "manage_interface_list_member" });
+      throw toolError(err, context, "manage_interface_list_member");
     }
   }
 };
@@ -10652,7 +10470,7 @@ var interfaceListTools = [
 ];
 
 // src/domain/tools/fleet-tools.ts
-import { z as z45 } from "zod";
+import { z as z46 } from "zod";
 
 // src/middleware/authz.ts
 function matchesPattern(name, pattern) {
@@ -10660,16 +10478,16 @@ function matchesPattern(name, pattern) {
   const prefix = pattern.slice(0, pattern.indexOf("*"));
   return name.startsWith(prefix);
 }
-function checkAuthz(identity, toolName, routerId) {
-  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId)) {
+function checkAuthz(identity, toolName, routerId2) {
+  if (identity.allowedRouters.length > 0 && !identity.allowedRouters.includes(routerId2)) {
     throw new MikroMCPError({
       category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
       code: "ROUTER_NOT_ALLOWED",
-      message: `Identity "${identity.id}" is not allowed to access router "${routerId}".`,
-      details: { identityId: identity.id, routerId, allowedRouters: identity.allowedRouters },
+      message: `Identity "${identity.id}" is not allowed to access router "${routerId2}".`,
+      details: { identityId: identity.id, routerId: routerId2, allowedRouters: identity.allowedRouters },
       recoverability: {
         retryable: false,
-        suggestedAction: `Add "${routerId}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
+        suggestedAction: `Add "${routerId2}" to allowedRouters for identity "${identity.id}" in identities.yaml.`
       }
     });
   }
@@ -10952,16 +10770,16 @@ function checkFleetConfirmation(args, secret) {
 
 // src/domain/tools/fleet-tools.ts
 var log47 = createLogger("fleet-tools");
-var checkHealthInputSchema = z45.object({
-  routerId: z45.string().describe("Target router to health-check")
+var checkHealthInputSchema = z46.object({
+  routerId
 }).strict();
-var bulkExecuteInputSchema = z45.object({
-  toolName: z45.string().describe("Name of the tool to fan out (must be a single-router tool)"),
-  routerIds: z45.array(z45.string()).optional().describe("Explicit list of router IDs to target"),
-  tags: z45.array(z45.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
-  params: z45.record(z45.string(), z45.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
-  concurrency: z45.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
-  confirmationToken: z45.string().optional().describe(
+var bulkExecuteInputSchema = z46.object({
+  toolName: z46.string().describe("Name of the tool to fan out (must be a single-router tool)"),
+  routerIds: z46.array(z46.string()).optional().describe("Explicit list of router IDs to target"),
+  tags: z46.array(z46.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
+  params: z46.record(z46.string(), z46.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
+  concurrency: z46.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
+  confirmationToken: z46.string().optional().describe(
     "Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool."
   )
 }).strict();
@@ -11018,7 +10836,7 @@ function createFleetTools(baseTools2) {
   const bulkExecuteTool = {
     name: "bulk_execute",
     title: "Bulk Execute",
-    description: "Fan out a single-router tool to multiple routers in parallel (up to `concurrency` at a time). Target routers via explicit routerIds or by tag. Non-destructive tools fan out immediately. Destructive tools require a two-step confirmation: call without `confirmationToken` to receive a fleet token (requires `MIKROMCP_CONFIRMATION_SECRET`), then re-call with that token to proceed. Returns per-router results with succeeded/failed counts.",
+    description: "Fan out a single-router tool to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Destructive tools need two-step confirmation: call without `confirmationToken` to get a fleet token (needs MIKROMCP_CONFIRMATION_SECRET), then re-call with it. Writes snapshot+journal each router for rollback. Returns per-router results with succeeded/failed counts.",
     inputSchema: bulkExecuteInputSchema,
     annotations: {
       readOnlyHint: false,
@@ -11150,8 +10968,12 @@ function createFleetTools(baseTools2) {
           }
         };
       }
+      const isWrite = !targetTool.annotations.readOnlyHint;
+      const snapshotDir = context.appConfig.snapshotDir;
+      const journalPath = context.appConfig.journalPath;
       async function runForRouter(router) {
         const start = Date.now();
+        let journalId;
         try {
           checkAuthz(context.identity, parsed.toolName, router.id);
           const routerContext = buildRouterToolContext({
@@ -11163,11 +10985,44 @@ function createFleetTools(baseTools2) {
             registry: context.routerRegistry
           });
           const toolParams = { ...parsed.params, routerId: router.id };
+          const snapshotIds = [];
+          if (isWrite && targetTool.snapshotPaths && targetTool.snapshotPaths.length > 0) {
+            for (const path of targetTool.snapshotPaths) {
+              try {
+                const meta = await takeSnapshot(
+                  routerContext.routerClient,
+                  router.id,
+                  path,
+                  snapshotDir
+                );
+                snapshotIds.push(meta.id);
+              } catch (err) {
+                log47.warn(
+                  { err, path, routerId: router.id },
+                  "bulk_execute snapshot failed \u2014 proceeding without snapshot"
+                );
+              }
+            }
+          }
+          if (isWrite && journalPath) {
+            journalId = recordAttempt({
+              journalPath,
+              identityId: context.identity.id,
+              role: context.identity.role,
+              tool: parsed.toolName,
+              routerId: router.id,
+              params: toolParams,
+              snapshotIds
+            });
+          }
           const result = await targetTool.handler(
             toolParams,
             routerContext
           );
           const elapsed = Date.now() - start;
+          if (journalId) {
+            recordOutcome({ journalPath, journalId, phase: "success", durationMs: elapsed });
+          }
           auditLog({
             type: "audit",
             ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -11184,6 +11039,9 @@ function createFleetTools(baseTools2) {
         } catch (err) {
           const elapsed = Date.now() - start;
           const message = err instanceof Error ? err.message : String(err);
+          if (journalId) {
+            recordOutcome({ journalPath, journalId, phase: "failure", outcome: message, durationMs: elapsed });
+          }
           auditLog({
             type: "audit",
             ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -11378,8 +11236,8 @@ function computeParamHash(params) {
   const { confirmationToken: _, ...rest } = params;
   return createHash3("sha256").update(JSON.stringify(rest)).digest("hex");
 }
-function computeToken(tool, routerId, identityId, paramHash, expiresAt, secret) {
-  const payload = JSON.stringify({ tool, routerId, paramHash, identityId, expiresAt });
+function computeToken(tool, routerId2, identityId, paramHash, expiresAt, secret) {
+  const payload = JSON.stringify({ tool, routerId: routerId2, paramHash, identityId, expiresAt });
   return createHmac2("sha256", secret).update(payload).digest("hex");
 }
 function evictExpired2() {
@@ -11388,7 +11246,7 @@ function evictExpired2() {
     if (entry.expiresAt <= now) pendingConfirmations.delete(token);
   }
 }
-async function checkConfirmation(toolName, routerId, params, identity, secret) {
+async function checkConfirmation(toolName, routerId2, params, identity, secret) {
   if (BYPASS_ROLES.includes(identity.role)) return;
   evictExpired2();
   const submittedToken = typeof params.confirmationToken === "string" ? params.confirmationToken : null;
@@ -11406,7 +11264,7 @@ async function checkConfirmation(toolName, routerId, params, identity, secret) {
       });
     }
     const currentParamHash = computeParamHash(params);
-    if (entry.tool !== toolName || entry.routerId !== routerId || entry.identityId !== identity.id || entry.paramHash !== currentParamHash) {
+    if (entry.tool !== toolName || entry.routerId !== routerId2 || entry.identityId !== identity.id || entry.paramHash !== currentParamHash) {
       throw new MikroMCPError({
         category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
         code: "CONFIRMATION_MISMATCH",
@@ -11422,11 +11280,11 @@ async function checkConfirmation(toolName, routerId, params, identity, secret) {
   }
   const expiresAt = new Date(Date.now() + CONFIRMATION_TTL_MS2).toISOString();
   const paramHash = computeParamHash(params);
-  const token = computeToken(toolName, routerId, identity.id, paramHash, expiresAt, secret);
+  const token = computeToken(toolName, routerId2, identity.id, paramHash, expiresAt, secret);
   pendingConfirmations.set(token, {
     expiresAt: new Date(expiresAt),
     tool: toolName,
-    routerId,
+    routerId: routerId2,
     identityId: identity.id,
     paramHash
   });
@@ -11438,7 +11296,7 @@ async function checkConfirmation(toolName, routerId, params, identity, secret) {
       confirmationToken: token,
       expiresAt,
       tool: toolName,
-      routerId
+      routerId: routerId2
     },
     recoverability: {
       retryable: true,
@@ -11578,8 +11436,8 @@ var DEFAULTS2 = {
   cooldownMs: 3e4
 };
 var CircuitBreaker = class {
-  constructor(routerId, options) {
-    this.routerId = routerId;
+  constructor(routerId2, options) {
+    this.routerId = routerId2;
     this.options = { ...DEFAULTS2, ...options };
   }
   routerId;
@@ -11588,15 +11446,22 @@ var CircuitBreaker = class {
   consecutiveFailures = 0;
   lastFailureTime = 0;
   probeInFlight = false;
+  /** Effective state, accounting for an elapsed cooldown. Pure — does not mutate. */
   get state() {
-    if (this.currentState === "open") {
-      const elapsed = Date.now() - this.lastFailureTime;
-      if (elapsed >= this.options.cooldownMs) {
-        this.currentState = "half-open";
-      }
+    if (this.currentState === "open" && this.cooldownElapsed()) {
+      return "half-open";
     }
     return this.currentState;
   }
+  cooldownElapsed() {
+    return Date.now() - this.lastFailureTime >= this.options.cooldownMs;
+  }
+  /** Apply the time-based open→half-open transition. Call before acting on state. */
+  transitionIfCooldownElapsed() {
+    if (this.currentState === "open" && this.cooldownElapsed()) {
+      this.currentState = "half-open";
+    }
+  }
   /**
    * Execute `fn` through the circuit breaker.
    *
@@ -11605,7 +11470,8 @@ var CircuitBreaker = class {
    * - **half-open**: execute as a probe; success closes, failure reopens.
    */
   async execute(fn) {
-    const currentState = this.state;
+    this.transitionIfCooldownElapsed();
+    const currentState = this.currentState;
     if (currentState === "open") {
       throw new MikroMCPError({
         category: "ROUTER_BUSY" /* ROUTER_BUSY */,
@@ -11677,6 +11543,26 @@ var CircuitBreaker = class {
 
 // src/mcp/tool-executor.ts
 var log48 = createLogger("tool-executor");
+function resolveRouterId(explicit, registry, config) {
+  if (explicit) {
+    return explicit;
+  }
+  const fallback = config.defaultRouter ?? registry.soleRouterId();
+  if (fallback) {
+    return fallback;
+  }
+  const available = registry.routerIds();
+  throw new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code: "MISSING_ROUTER_ID",
+    message: available.length > 0 ? `routerId is required: more than one router is configured. Available: ${available.join(", ")}.` : "routerId is required, but no routers are configured.",
+    details: { availableRouters: available },
+    recoverability: {
+      retryable: false,
+      suggestedAction: available.length > 0 ? "Provide a routerId, or set MIKROMCP_DEFAULT_ROUTER to choose a default." : "Configure at least one router in routers.yaml."
+    }
+  });
+}
 async function executeToolCall(tool, args, deps) {
   const { registry, pool, circuitBreakers, config, identityRegistry } = deps;
   const correlationId = nanoid4();
@@ -11702,27 +11588,17 @@ async function executeToolCall(tool, args, deps) {
         recordToolCall(tool.name, "success");
         return formatToolResult(fleetResult);
       }
-      const routerId = args.routerId;
-      if (!routerId) {
-        throw new MikroMCPError({
-          category: "VALIDATION" /* VALIDATION */,
-          code: "MISSING_ROUTER_ID",
-          message: "routerId is required",
-          recoverability: {
-            retryable: false,
-            suggestedAction: "Provide a valid routerId parameter."
-          }
-        });
-      }
-      checkAuthz(identity, tool.name, routerId);
-      const routerConfig = registry.getRouter(routerId);
+      const routerId2 = resolveRouterId(args.routerId, registry, config);
+      args.routerId = routerId2;
+      checkAuthz(identity, tool.name, routerId2);
+      const routerConfig = registry.getRouter(routerId2);
       if (tool.annotations.destructiveHint) {
         const windows = routerConfig.maintenanceWindows;
         if (windows && windows.length > 0 && !isWithinMaintenanceWindow(windows, /* @__PURE__ */ new Date())) {
           throw new MikroMCPError({
             category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
             code: "OUTSIDE_MAINTENANCE_WINDOW",
-            message: `Router "${routerId}" has maintenance windows configured. Destructive operations are only permitted during scheduled windows.`,
+            message: `Router "${routerId2}" has maintenance windows configured. Destructive operations are only permitted during scheduled windows.`,
             details: { maintenanceWindows: windows },
             recoverability: {
               retryable: true,
@@ -11732,7 +11608,7 @@ async function executeToolCall(tool, args, deps) {
         }
       }
       if (tool.annotations.destructiveHint && config.confirmationSecret) {
-        await checkConfirmation(tool.name, routerId, args, identity, config.confirmationSecret);
+        await checkConfirmation(tool.name, routerId2, args, identity, config.confirmationSecret);
       }
       const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
       if (shouldAudit) {
@@ -11743,7 +11619,7 @@ async function executeToolCall(tool, args, deps) {
           identityId: identity.id,
           role: identity.role,
           tool: tool.name,
-          routerId,
+          routerId: routerId2,
           phase: "attempt",
           params: args
         }, config.auditLogPath);
@@ -11756,13 +11632,13 @@ async function executeToolCall(tool, args, deps) {
         config,
         registry
       });
-      let cb = circuitBreakers.get(routerId);
+      let cb = circuitBreakers.get(routerId2);
       if (!cb) {
-        cb = new CircuitBreaker(routerId, {
+        cb = new CircuitBreaker(routerId2, {
           failureThreshold: config.circuitBreaker.failureThreshold,
           cooldownMs: config.circuitBreaker.cooldownMs
         });
-        circuitBreakers.set(routerId, cb);
+        circuitBreakers.set(routerId2, cb);
       }
       toolContext.circuitBreaker = cb;
       const { confirmationToken: _ct, ...handlerArgs } = args;
@@ -11770,11 +11646,11 @@ async function executeToolCall(tool, args, deps) {
       if (tool.snapshotPaths && tool.snapshotPaths.length > 0 && !tool.annotations.readOnlyHint) {
         for (const path of tool.snapshotPaths) {
           try {
-            const meta = await takeSnapshot(toolContext.routerClient, routerId, path, config.snapshotDir);
+            const meta = await takeSnapshot(toolContext.routerClient, routerId2, path, config.snapshotDir);
             snapshotIds.push(meta.id);
             log48.debug({ snapshotId: meta.id, path }, "Snapshot taken");
           } catch (err) {
-            log48.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
+            log48.warn({ err, path, routerId: routerId2 }, "Snapshot failed \u2014 proceeding without snapshot");
           }
         }
       }
@@ -11784,7 +11660,7 @@ async function executeToolCall(tool, args, deps) {
           identityId: identity.id,
           role: identity.role,
           tool: tool.name,
-          routerId,
+          routerId: routerId2,
           params: handlerArgs,
           snapshotIds
         });
@@ -11810,13 +11686,13 @@ async function executeToolCall(tool, args, deps) {
           identityId: identity.id,
           role: identity.role,
           tool: tool.name,
-          routerId,
+          routerId: routerId2,
           phase: "success",
           params: args,
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log48.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
+      log48.info({ tool: tool.name, routerId: routerId2, correlationId }, "Tool executed successfully");
       recordToolCall(tool.name, "success");
       return formatToolResult(result);
     } catch (err) {
@@ -11839,7 +11715,7 @@ async function executeToolCall(tool, args, deps) {
       }
       const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
       if (shouldAudit && error.category !== "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */) {
-        const routerId = args.routerId ?? "unknown";
+        const routerId2 = args.routerId ?? "unknown";
         const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
         auditLog({
           type: "audit",
@@ -11848,7 +11724,7 @@ async function executeToolCall(tool, args, deps) {
           identityId: identity.id,
           role: identity.role,
           tool: tool.name,
-          routerId,
+          routerId: routerId2,
           phase: "failure",
           params: args,
           outcome: error.code,
@@ -11868,7 +11744,7 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
   const deps = { registry, pool, circuitBreakers, config, identityRegistry };
   for (const tool of allTools) {
     const registrationSchema = tool.annotations.destructiveHint ? tool.inputSchema.extend({
-      confirmationToken: z46.string().optional().describe(
+      confirmationToken: z47.string().optional().describe(
         "Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action."
       )
     }) : tool.inputSchema;
@@ -11890,41 +11766,41 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
 // src/config/router-registry.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
 import { parse } from "yaml";
-import { z as z47 } from "zod";
+import { z as z48 } from "zod";
 var log50 = createLogger("router-registry");
-var RouterConfigSchema = z47.object({
-  host: z47.string().min(1, "host is required"),
-  port: z47.number().int().min(1).max(65535),
-  tls: z47.object({
-    enabled: z47.boolean(),
-    rejectUnauthorized: z47.boolean(),
-    ca: z47.string().optional(),
-    fingerprint: z47.string().optional()
+var RouterConfigSchema = z48.object({
+  host: z48.string().min(1, "host is required"),
+  port: z48.number().int().min(1).max(65535),
+  tls: z48.object({
+    enabled: z48.boolean(),
+    rejectUnauthorized: z48.boolean(),
+    ca: z48.string().optional(),
+    fingerprint: z48.string().optional()
   }).strict(),
-  credentials: z47.object({
-    source: z47.enum(["env", "vault"]),
-    envPrefix: z47.string().optional(),
-    vaultPath: z47.string().optional()
+  credentials: z48.object({
+    source: z48.enum(["env", "vault"]),
+    envPrefix: z48.string().optional(),
+    vaultPath: z48.string().optional()
   }).strict(),
-  tags: z47.array(z47.string()).default([]),
-  rosVersion: z47.string().min(1),
-  sshPort: z47.number().int().min(1).max(65535).optional(),
-  sshFingerprint: z47.string().optional(),
-  cmdAllow: z47.array(z47.string()).optional(),
-  cmdDeny: z47.array(z47.string()).optional(),
-  maintenanceWindows: z47.array(
-    z47.object({
-      days: z47.array(
-        z47.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
+  tags: z48.array(z48.string()).default([]),
+  rosVersion: z48.string().min(1),
+  sshPort: z48.number().int().min(1).max(65535).optional(),
+  sshFingerprint: z48.string().optional(),
+  cmdAllow: z48.array(z48.string()).optional(),
+  cmdDeny: z48.array(z48.string()).optional(),
+  maintenanceWindows: z48.array(
+    z48.object({
+      days: z48.array(
+        z48.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
       ),
-      startTime: z47.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
-      endTime: z47.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
-      timezone: z47.string().min(1)
+      startTime: z48.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
+      endTime: z48.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
+      timezone: z48.string().min(1)
     }).strict()
   ).optional()
 }).strict();
-var ConfigFileSchema = z47.object({
-  routers: z47.record(z47.string(), RouterConfigSchema)
+var ConfigFileSchema = z48.object({
+  routers: z48.record(z48.string(), RouterConfigSchema)
 }).strict();
 var RouterRegistry = class {
   routers;
@@ -11969,6 +11845,14 @@ ${issues}`);
   hasRouter(id) {
     return this.routers.has(id);
   }
+  /** The id of the only configured router, or undefined when zero or more than one exist. */
+  soleRouterId() {
+    return this.routers.size === 1 ? this.routers.keys().next().value : void 0;
+  }
+  /** All configured router ids, for error messages and discovery. */
+  routerIds() {
+    return Array.from(this.routers.keys());
+  }
 };
 
 // src/adapter/rest-client.ts
@@ -12064,10 +11948,10 @@ function buildListQuery(options) {
   }
   return { method: "GET" };
 }
-function applyPagination(items, limit, offset) {
+function applyPagination(items, limit2, offset2) {
   const total = items.length;
-  const start = offset ?? 0;
-  const sliced = limit !== void 0 ? items.slice(start, start + limit) : items.slice(start);
+  const start = offset2 ?? 0;
+  const sliced = limit2 !== void 0 ? items.slice(start, start + limit2) : items.slice(start);
   return {
     items: sliced,
     total,
@@ -12207,8 +12091,8 @@ var ConnectionPool = class {
    * Perform a lightweight health check against a router by fetching
    * `/rest/system/resource`. Returns `true` if the request succeeds.
    */
-  async healthCheck(routerId) {
-    const client = this.clients.get(routerId);
+  async healthCheck(routerId2) {
+    const client = this.clients.get(routerId2);
     if (!client) {
       return false;
     }
@@ -12220,11 +12104,11 @@ var ConnectionPool = class {
     }
   }
   /** Remove and close a single client by router ID. */
-  removeClient(routerId) {
-    const client = this.clients.get(routerId);
+  removeClient(routerId2) {
+    const client = this.clients.get(routerId2);
     if (client) {
       client.close();
-      this.clients.delete(routerId);
+      this.clients.delete(routerId2);
     }
   }
   /** Close and remove all clients. */
@@ -12237,18 +12121,30 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.5.0";
+var VERSION = "1.6.0";
 
 // src/mcp/server.ts
+var SERVER_INSTRUCTIONS = [
+  "MikroMCP manages MikroTik RouterOS devices.",
+  "Reads are safe; treat writes as consequential \u2014 preview a write with dryRun:true and review the diff before applying.",
+  "Destructive operations may require a two-step confirmation token.",
+  "Writes are idempotent: already_exists and no_change are success, not errors.",
+  "Prefer dedicated tools over run_command.",
+  "routerId is optional when a default router is configured.",
+  "For the full operating playbook, install the MikroMCP usage skill."
+].join(" ");
 function createServerFactory(config, identityRegistry) {
   const registry = new RouterRegistry(config.configPath);
   const pool = new ConnectionPool();
   const circuitBreakers = /* @__PURE__ */ new Map();
   const makeServer = () => {
-    const server = new McpServer({
-      name: "mikromcp",
-      version: VERSION
-    });
+    const server = new McpServer(
+      {
+        name: "mikromcp",
+        version: VERSION
+      },
+      { instructions: SERVER_INSTRUCTIONS }
+    );
     registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry);
     return server;
   };
@@ -12478,17 +12374,17 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 // src/config/identity-registry.ts
 import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
 import { parse as parse2 } from "yaml";
-import { z as z48 } from "zod";
+import { z as z49 } from "zod";
 import bcrypt from "bcryptjs";
 var log52 = createLogger("identity-registry");
-var IdentityConfigSchema = z48.object({
-  token: z48.string().min(1, "token hash is required"),
-  role: z48.enum(["readonly", "operator", "admin", "superadmin"]),
-  allowedRouters: z48.array(z48.string()).default([]),
-  allowedToolPatterns: z48.array(z48.string()).default([])
+var IdentityConfigSchema = z49.object({
+  token: z49.string().min(1, "token hash is required"),
+  role: z49.enum(["readonly", "operator", "admin", "superadmin"]),
+  allowedRouters: z49.array(z49.string()).default([]),
+  allowedToolPatterns: z49.array(z49.string()).default([])
 }).strict();
-var ConfigFileSchema2 = z48.object({
-  identities: z48.record(z48.string(), IdentityConfigSchema)
+var ConfigFileSchema2 = z49.object({
+  identities: z49.record(z49.string(), IdentityConfigSchema)
 }).strict();
 var IdentityRegistry = class {
   identities = [];
@@ -12636,7 +12532,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.5.0";
+var localVersion = "1.6.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -12729,6 +12625,26 @@ function checkEnvVars(routers, transport2) {
     warn("MIKROMCP_CONFIRMATION_SECRET not set \u2014 required in HTTP mode");
   }
 }
+function checkDefaultRouter(defaultRouter, routers) {
+  const ids = routers.map((r) => r.id);
+  if (defaultRouter) {
+    if (ids.includes(defaultRouter)) {
+      ok(`Default router: ${defaultRouter} (MIKROMCP_DEFAULT_ROUTER; used when routerId is omitted)`);
+    } else {
+      fail(
+        `MIKROMCP_DEFAULT_ROUTER="${defaultRouter}" does not match any configured router` + (ids.length > 0 ? ` (available: ${ids.join(", ")})` : "")
+      );
+    }
+    return;
+  }
+  if (routers.length === 1) {
+    ok(`Default router: ${ids[0]} (sole configured router; used when routerId is omitted)`);
+  } else if (routers.length > 1) {
+    warn(
+      `No MIKROMCP_DEFAULT_ROUTER set and ${routers.length} routers configured \u2014 tool calls must specify routerId (set MIKROMCP_DEFAULT_ROUTER to choose a default)`
+    );
+  }
+}
 async function checkRouter(router) {
   console.log();
   console.log(chalk.bold(`Router: ${router.id} (${router.host})`));
@@ -12846,6 +12762,16 @@ function checkClaudeDesktop() {
     warn(`Could not parse Claude Desktop config: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+function checkSkill() {
+  const skillPath = `${homedir2()}/.claude/skills/mikromcp/SKILL.md`;
+  if (existsSync3(skillPath)) {
+    ok("Usage skill: installed (~/.claude/skills/mikromcp)");
+  } else {
+    warn(
+      "Usage skill not installed at ~/.claude/skills/mikromcp \u2014 your AI assistant will lack MikroMCP operating guidance. See docs/wiki/Using-the-Skill.md"
+    );
+  }
+}
 async function checkForUpdates() {
   try {
     const response = await fetch("https://registry.npmjs.org/mikromcp/latest", {
@@ -12883,12 +12809,16 @@ async function runDoctor() {
   if (routers.length > 0) {
     checkEnvVars(routers, appConfig.transport);
   }
+  if (routers.length > 0) {
+    checkDefaultRouter(appConfig.defaultRouter, routers);
+  }
   for (const router of routers) {
     await checkRouter(router);
   }
   console.log();
   checkIdentities(appConfig.identitiesPath, appConfig.transport);
   checkClaudeDesktop();
+  checkSkill();
   await checkForUpdates();
   console.log();
   console.log(chalk.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
@@ -12940,8 +12870,8 @@ function toYaml(obj) {
   });
   return doc.toString();
 }
-function suggestEnvPrefix(routerId) {
-  return "ROUTER_" + routerId.toUpperCase().replace(/-/g, "_");
+function suggestEnvPrefix(routerId2) {
+  return "ROUTER_" + routerId2.toUpperCase().replace(/-/g, "_");
 }
 function validateRouterId(val) {
   if (/^[a-zA-Z0-9-]+$/.test(val)) return true;
@@ -12959,7 +12889,7 @@ function findClaudeDesktopConfig() {
 }
 async function collectRouterInfo() {
   console.log(chalk2.bold("\n\u2500\u2500 Router configuration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  const routerId = await input({
+  const routerId2 = await input({
     message: "Router ID (e.g. core-01):",
     validate: validateRouterId
   });
@@ -12991,7 +12921,7 @@ async function collectRouterInfo() {
       );
     }
   }
-  const suggestedPrefix = suggestEnvPrefix(routerId);
+  const suggestedPrefix = suggestEnvPrefix(routerId2);
   const envPrefix = await input({
     message: "Credential env prefix:",
     default: suggestedPrefix,
@@ -13015,7 +12945,13 @@ async function collectRouterInfo() {
     default: "7",
     validate: (v) => v.trim().length > 0 ? true : "Version is required"
   });
-  return { routerId, host, port, tlsEnabled, rejectUnauthorized, envPrefix, routerUser, routerPass, tags, rosVersion };
+  return { routerId: routerId2, host, port, tlsEnabled, rejectUnauthorized, envPrefix, routerUser, routerPass, tags, rosVersion };
+}
+async function collectDefaultRouterPreference(routerId2) {
+  return confirm({
+    message: `Set "${routerId2}" as the default router? (tools may then omit routerId)`,
+    default: true
+  });
 }
 async function collectIdentityInfo() {
   console.log(chalk2.bold("\n\u2500\u2500 Identity / HTTP transport \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
@@ -13165,6 +13101,10 @@ function writeDotEnv(data) {
     `MIKROMCP_CONFIG_PATH=${join4(data.configDir, "routers.yaml")}`,
     `MIKROMCP_IDENTITIES_PATH=${join4(data.configDir, "identities.yaml")}`,
     "",
+    "# \u2500\u2500 Default router \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    "# Router used when a tool call omits routerId (handy for single-router setups).",
+    data.setAsDefault ? `MIKROMCP_DEFAULT_ROUTER=${data.routerId}` : `# MIKROMCP_DEFAULT_ROUTER=${data.routerId}`,
+    "",
     "# \u2500\u2500 Logging \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     "# Levels: trace | debug | info | warn | error",
     "MIKROMCP_LOG_LEVEL=info",
@@ -13231,6 +13171,7 @@ async function runInit() {
     }
   }
   const routerInfo = await collectRouterInfo();
+  const setAsDefault = await collectDefaultRouterPreference(routerInfo.routerId);
   const identityInfo = await collectIdentityInfo();
   const transport2 = await collectTransport();
   const writeEnv = await collectEnvPreference();
@@ -13241,6 +13182,7 @@ async function runInit() {
     transport: transport2,
     envPath,
     configDir,
+    setAsDefault,
     writeEnv,
     writeRoutersYaml: true,
     writeIdentitiesYaml: identityInfo.createIdentity,
@@ -13262,6 +13204,16 @@ async function runInit() {
     writeDotEnv(data);
     summary.push(`.env written to ${data.envPath}`);
     console.log(chalk2.green(`  \u2714  ${data.envPath}`));
+    if (data.setAsDefault) {
+      summary.push(`default router: ${data.routerId}`);
+      console.log(chalk2.green(`  \u2714  Default router: ${data.routerId} (MIKROMCP_DEFAULT_ROUTER)`));
+    }
+  } else if (data.setAsDefault) {
+    console.log(
+      chalk2.yellow(
+        `  \u26A0  Default router not persisted \u2014 set MIKROMCP_DEFAULT_ROUTER=${data.routerId} in your environment to use it.`
+      )
+    );
   }
   let desktopRegistered = false;
   if (data.registerClaudeDesktop) {
@@ -13284,11 +13236,15 @@ async function runInit() {
   console.log(chalk2.bold("\nNext steps:"));
   console.log(chalk2.dim("  1. Run: mikromcp doctor"));
   console.log(chalk2.dim("  2. Restart Claude Desktop to load the MCP server"));
+  console.log(
+    chalk2.dim("  3. (Optional) Install the usage skill so your AI assistant drives MikroMCP safely")
+  );
+  console.log(chalk2.dim("     See: docs/wiki/Using-the-Skill.md"));
   console.log();
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.5.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.6.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);