mikromcp 1.8.0 → 1.9.0

package/dist/main.js

@@ -126,7 +126,7 @@ function loadAppConfig() {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/tool-registry.ts
-import { z as z47 } from "zod";
+import { z as z48 } from "zod";
 
 // src/domain/tools/system-tools.ts
 import { z as z2 } from "zod";
@@ -301,9 +301,24 @@ function enrichError(error, context) {
 }
 
 // src/domain/tools/tool-definition.ts
+function snapshotPathsFor(tool, params) {
+  return typeof tool.snapshotPaths === "function" ? tool.snapshotPaths(params) : tool.snapshotPaths ?? [];
+}
 function toolError(err, context, tool) {
   return enrichError(err, { routerId: context.routerId, tool });
 }
+function unavailableCapability(code, message, suggestedAction) {
+  return new Proxy({}, {
+    get() {
+      throw new MikroMCPError({
+        category: "INTERNAL" /* INTERNAL */,
+        code,
+        message,
+        recoverability: { retryable: false, suggestedAction }
+      });
+    }
+  });
+}
 
 // src/observability/logger.ts
 import pino from "pino";
@@ -4950,11 +4965,11 @@ var listFilesTool = {
       if (parsed.name !== void 0) {
         const needle = parsed.name.toLowerCase();
         files = files.filter(
-          (f) => (f.name ?? "").toLowerCase().includes(needle)
+          (f2) => (f2.name ?? "").toLowerCase().includes(needle)
         );
       }
       if (parsed.type !== void 0) {
-        files = files.filter((f) => f.type === parsed.type);
+        files = files.filter((f2) => f2.type === parsed.type);
       }
       return {
         content: listContent(
@@ -4963,7 +4978,7 @@ var listFilesTool = {
           files,
           files.length,
           0,
-          (f) => compactFields(f, ["name", "type", "size", "creation-time"])
+          (f2) => compactFields(f2, ["name", "type", "size", "creation-time"])
         ),
         structuredContent: { routerId: context.routerId, files, total: files.length }
       };
@@ -4995,7 +5010,7 @@ var getFileContentTool = {
         limit: void 0,
         offset: void 0
       });
-      const file = all.find((f) => f.name === parsed.name);
+      const file = all.find((f2) => f2.name === parsed.name);
       if (!file) {
         throw new MikroMCPError({
           category: "NOT_FOUND" /* NOT_FOUND */,
@@ -5127,7 +5142,7 @@ var deleteFileTool = {
         limit: void 0,
         offset: void 0
       });
-      const file = all.find((f) => f.name === parsed.name);
+      const file = all.find((f2) => f2.name === parsed.name);
       if (!file) {
         return {
           content: `File "${parsed.name}" not found on ${context.routerId}. Nothing to delete.`,
@@ -5398,221 +5413,1342 @@ var containerTools = [listContainersTool, manageContainerTool];
 
 // src/domain/tools/change-management-tools.ts
 import { z as z24 } from "zod";
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 
 // src/domain/snapshot/snapshot-engine.ts
 import { mkdir, writeFile, readFile } from "fs/promises";
 import { join as join2 } from "path";
 import { nanoid } from "nanoid";
 
-// src/domain/snapshot/diff-engine.ts
-var RUNTIME_FIELDS = /* @__PURE__ */ new Set([
-  "bytes",
-  "packets",
-  "dynamic",
-  "invalid",
-  "dead",
-  "expired",
-  "active",
-  "running",
-  "about",
-  ".about",
-  ".nextid",
-  "creation-time",
-  "last-logged-in",
-  "last-link-up-time",
-  "last-link-down-time",
-  "link-downs",
-  "rx-byte",
-  "tx-byte",
-  "rx-packet",
-  "tx-packet",
-  "uptime"
-]);
-var ORDER_SENSITIVE_PATHS = /* @__PURE__ */ new Set([
-  "ip/firewall/filter",
-  "ip/firewall/nat",
-  "ip/firewall/mangle",
-  "routing/rule"
-]);
-function normalizeForDiff(records) {
-  const out = [];
-  for (const r of records) {
-    if (isTrue(r.dynamic)) continue;
-    const clean = {};
-    for (const [k, v] of Object.entries(r)) {
-      if (!RUNTIME_FIELDS.has(k)) clean[k] = v;
+// src/adapter/swos-client.ts
+import { createHash, randomBytes } from "crypto";
+import { request as httpRequest } from "http";
+
+// src/adapter/swos-protocol.ts
+var Kind = {
+  BOOL: "bool",
+  STR: "str",
+  OPTION: "option",
+  MAC: "mac",
+  IP: "ip",
+  INT: "int",
+  CHECKBOX: "checkbox",
+  HEX: "hex"
+};
+function f(name, keys, kind, opts = {}) {
+  return { name, keys, kind, ...opts };
+}
+var KEY_QUOTE = /([{,])([a-zA-Z][a-zA-Z0-9]*)/g;
+var HEX_QUOTE = /(0x[0-9a-fA-F]+)/g;
+var HEX_UNQUOTE = /"0x([0-9a-fA-F]+)"/g;
+var KEY_UNQUOTE = /"([a-zA-Z][a-zA-Z0-9]*)":/g;
+var HEX_TOKEN = /^0x[0-9a-fA-F]+$/;
+function isWireHex(value) {
+  return typeof value === "string" && HEX_TOKEN.test(value);
+}
+function quoteBrokenJson(text) {
+  return text.replace(KEY_QUOTE, '$1"$2"').replace(/'/g, '"').replace(HEX_QUOTE, '"$1"');
+}
+function normalize(value) {
+  if (typeof value === "string") {
+    if (isWireHex(value)) {
+      const parsed = Number.parseInt(value, 16);
+      return Number.isNaN(parsed) ? value : parsed;
     }
-    out.push(clean);
+    return value;
   }
-  return out;
-}
-var SEMANTIC_KEYS = {
-  "ip/route": ["dst-address", "gateway", "routing-table"],
-  "ip/firewall/filter": ["comment"],
-  "ip/firewall/nat": ["comment"],
-  "ip/firewall/mangle": ["comment"],
-  "ip/firewall/address-list": ["list", "address"],
-  "ip/address": ["address", "interface"],
-  "ip/dns/static": ["name", "type"],
-  "routing/rule": ["src-address", "routing-table"],
-  "routing/table": ["name"],
-  "interface/wireguard/peers": ["public-key"],
-  "interface/bridge": ["name"],
-  "interface/bridge/port": ["bridge", "interface"],
-  "system/scheduler": ["name"],
-  "system/script": ["name"],
-  "system/package": ["name"],
-  "container": ["name"],
-  "certificate": ["name"],
-  "file": ["name"],
-  "interface/vrrp": ["name"],
-  "ip/dhcp-server": ["name"],
-  "ip/ipsec/peer": ["name"],
-  "ip/pool": ["name"],
-  "queue/simple": ["name"],
-  "tool/netwatch": ["host"],
-  "user": ["name"]
-};
-function normalizeValue(v) {
-  if (v === true || v === "true" || v === "yes") return "true";
-  if (v === false || v === "false" || v === "no") return "false";
-  return String(v ?? "");
-}
-function semanticKey(record, keys) {
-  return keys.map((k) => normalizeValue(record[k] ?? "")).join("|");
+  if (Array.isArray(value)) return value.map(normalize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [k, normalize(v)])
+    );
+  }
+  return value;
 }
-function recordSignature(record) {
-  return Object.entries(record).filter(([k]) => k !== ".id").sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${normalizeValue(v)}`).join(";");
+function parseWireBlob(text) {
+  return JSON.parse(quoteBrokenJson(text));
 }
-function recordsAreEqual(a, b) {
-  const keysA = Object.keys(a).filter((k) => k !== ".id");
-  const keysB = Object.keys(b).filter((k) => k !== ".id");
-  if (keysA.length !== keysB.length) return false;
-  return keysA.every((k) => normalizeValue(a[k]) === normalizeValue(b[k] ?? ""));
+function parseBlob(text) {
+  return normalize(parseWireBlob(text));
 }
-function hasDuplicateKeys(records, keys) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const r of records) {
-    const k = semanticKey(r, keys);
-    if (seen.has(k)) return true;
-    seen.add(k);
+var MAX_WIRE_VALUE = 4294967295;
+function toWireHex(value) {
+  if (!Number.isInteger(value) || value < 0 || value > MAX_WIRE_VALUE) {
+    throw new MikroMCPError({
+      category: "VALIDATION" /* VALIDATION */,
+      code: "SWOS_VALUE_OUT_OF_RANGE",
+      message: `Cannot encode ${value} as a SwOS wire value.`,
+      details: { value, min: 0, max: MAX_WIRE_VALUE },
+      recoverability: {
+        retryable: false,
+        suggestedAction: `Pass a whole number between 0 and ${MAX_WIRE_VALUE}.`
+      }
+    });
   }
-  return false;
-}
-function applyUserRestriction(path, plan) {
-  if (path === "user" && plan.toCreate.length > 0) {
-    plan.warnings.push(
-      `Refusing to recreate ${plan.toCreate.length} deleted user(s): passwords are not stored in snapshots and recreation would produce password-less logins. Recreate manually with manage_user.`
+  const s = value.toString(16);
+  return `0x${s.length % 2 ? `0${s}` : s}`;
+}
+function encodeLike(value, existing) {
+  const token = toWireHex(value);
+  if (!isWireHex(existing)) return token;
+  const width = existing.length - 2;
+  const digits = token.slice(2);
+  return digits.length >= width ? token : `0x${digits.padStart(width, "0")}`;
+}
+function toHex(value) {
+  if (typeof value === "number") return toWireHex(value);
+  if (Array.isArray(value)) return value.map(toHex);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).map(([k, v]) => [k, toHex(v)])
     );
-    plan.toCreate = [];
   }
-  return plan;
+  return value;
 }
-function computeRestorePlan(path, beforeRaw, currentRaw) {
-  const before = normalizeForDiff(beforeRaw);
-  const current = normalizeForDiff(currentRaw);
-  const warnings = [];
-  if (ORDER_SENSITIVE_PATHS.has(path)) {
-    warnings.push(
-      `Restored entries for ${path} are re-created at the end of the list \u2014 rule ORDER is not restored. Review ordering manually after rollback.`
-    );
-  }
-  const keys = SEMANTIC_KEYS[path];
-  const canUseKeys = keys !== void 0 && !hasDuplicateKeys(before, keys) && !hasDuplicateKeys(current, keys);
-  if (!canUseKeys) {
-    const beforeSigs = new Set(before.map(recordSignature));
-    const currentSigs = new Set(current.map(recordSignature));
-    return applyUserRestriction(path, {
-      path,
-      toCreate: before.filter((r) => !currentSigs.has(recordSignature(r))),
-      toRemove: current.filter((r) => !beforeSigs.has(recordSignature(r))).map((r) => r[".id"]),
-      toUpdate: [],
-      warnings
-    });
+function dumpBlob(data) {
+  let s = JSON.stringify(toHex(data));
+  s = s.replace(HEX_UNQUOTE, "0x$1");
+  s = s.replace(KEY_UNQUOTE, "$1:");
+  return s.replace(/"/g, "'");
+}
+var SPEED = ["10M", "100M", "1G", "10G", "200M", "2.5G", "5G", "down"];
+var POE_OUT = ["off", "on", "auto"];
+var POE_VOLTAGE = ["auto", "low", "high"];
+var VLAN_MODE = ["disabled", "optional", "strict"];
+var VLAN_RECV = ["any", "only_tagged", "only_untagged"];
+var POE_STATE = [
+  "none",
+  "disabled",
+  "waiting_for_load",
+  "powered_on",
+  "overload",
+  "short_circuit",
+  "voltage_too_low",
+  "current_too_low",
+  "power_cycle",
+  "voltage_too_high",
+  "controller_error"
+];
+var RSTP_ROLE = ["disabled", "alternate", "root", "designated", "backup"];
+var FLOW_CONTROL = ["off", "tx_only", "rx_only", "on"];
+var ACL_VLAN_PRESENT = ["any", "present", "not present"];
+var ACL_ACCOUNT_AS = ["none", "#1", "#2", "#3", "#4"];
+var ADDR_ACQ = ["DHCP with fallback", "static", "DHCP only"];
+var LINK = {
+  path: "link.b",
+  fields: [
+    f("enabled", { swos: "en", swos_lite: "i01" }, Kind.BOOL),
+    f("auto_neg", { swos: "an", swos_lite: "i02" }, Kind.BOOL),
+    f("manual_duplex", { swos: "dpxc", swos_lite: "i03" }, Kind.BOOL),
+    f("manual_speed", { swos: "spd", swos_lite: "i05" }, Kind.OPTION, {
+      options: SPEED,
+      perPort: true
+    }),
+    f("link", { swos: "lnk", swos_lite: "i06" }, Kind.BOOL),
+    f("duplex", { swos: "dpx", swos_lite: "i07" }, Kind.BOOL),
+    f("speed", { swos: "spdc", swos_lite: "i08" }, Kind.OPTION, { options: SPEED, perPort: true }),
+    f("name", { swos: "nm", swos_lite: "i0a" }, Kind.STR, { perPort: true }),
+    f("flow_rx", { swos: "fctr", swos_lite: "i12" }, Kind.BOOL),
+    f("flow_tx", { swos: "fctc", swos_lite: "i16" }, Kind.BOOL),
+    f("pause", { swos: "paus", swos_lite: "i15" }, Kind.BOOL),
+    f("cable_pairs", { swos_lite: "i11" }, Kind.INT, {
+      perPort: true,
+      note: "per-port cable-pair status; 0xffff = all pairs OK"
+    }),
+    f("flow_control", { swos_lite: "i13" }, Kind.OPTION, {
+      options: FLOW_CONTROL,
+      note: "negotiated flow-control mode"
+    }),
+    f("flow_control_mask", { swos_lite: "i14" }, Kind.BOOL, {
+      note: "per-port mask paired with flow_control (i13)"
+    }),
+    f("cable_length", { swos_lite: "i09" }, Kind.INT, {
+      perPort: true,
+      unknown: true,
+      note: "0 when link down; tracks cable run length -> likely length, scale ~1e-3 m (heuristic)"
+    }),
+    f("unknown_i0b", { swos_lite: "i0b" }, Kind.HEX, { unknown: true }),
+    f("unknown_i0c", { swos_lite: "i0c" }, Kind.HEX, { unknown: true }),
+    f("diag_hops", { swos_lite: "i0d" }, Kind.HEX, { perPort: true, unknown: true }),
+    f("diag_last_hop", { swos_lite: "i0e" }, Kind.HEX, { perPort: true, unknown: true }),
+    f("diag_length", { swos_lite: "i0f" }, Kind.HEX, { perPort: true, unknown: true }),
+    f("diag_fault_at", { swos_lite: "i10" }, Kind.HEX, { perPort: true, unknown: true })
+  ]
+};
+var SYS = {
+  path: "sys.b",
+  fields: [
+    f("uptime", { swos: "upt", swos_lite: "i01" }, Kind.INT, { note: "seconds" }),
+    f("ip", { swos: "cip", swos_lite: "i02" }, Kind.IP),
+    f("mac", { swos: "mac", swos_lite: "i03" }, Kind.MAC),
+    f("serial", { swos: "sid", swos_lite: "i04" }, Kind.STR),
+    f("identity", { swos: "id", swos_lite: "i05" }, Kind.STR),
+    f("version", { swos: "ver", swos_lite: "i06" }, Kind.STR),
+    f("model", { swos: "brd", swos_lite: "i07" }, Kind.STR),
+    f("discovery_protocol", { swos: "dsc", swos_lite: "i08" }, Kind.BOOL, {
+      note: "per-port bitmask of MikroTik discovery enabled"
+    }),
+    f("static_ip", { swos: "sip", swos_lite: "i09" }, Kind.IP),
+    f("addr_acq", { swos: "iptp", swos_lite: "i0a" }, Kind.OPTION, { options: ADDR_ACQ }),
+    f("build_number", { swos_lite: "i0b" }, Kind.INT, { unknown: true }),
+    f("allow_from_ports", { swos: "allp", swos_lite: "i12" }, Kind.BOOL),
+    f("dhcp_trusted_ports", { swos: "dtrp", swos_lite: "i13" }, Kind.BOOL),
+    f("dhcp_info_option", { swos: "ainf", swos_lite: "i14" }, Kind.CHECKBOX),
+    f("psu1_voltage", { swos: "p1v", swos_lite: "i15" }, Kind.INT, { scale: 100, note: "volts" }),
+    f("psu1_current", { swos: "p1c", swos_lite: "i16" }, Kind.INT, { note: "mA" }),
+    f("igmp_snooping", { swos: "igmp", swos_lite: "i17" }, Kind.CHECKBOX),
+    f("allow_from_ip", { swos: "alla", swos_lite: "i19" }, Kind.IP),
+    f("allow_from_mask", { swos: "allm", swos_lite: "i1a" }, Kind.INT),
+    f("allow_from_vlan", { swos: "avln", swos_lite: "i1b" }, Kind.INT),
+    f("psu2_voltage", { swos: "p2v", swos_lite: "i1e" }, Kind.INT, { scale: 100 }),
+    f("psu2_current", { swos: "p2c", swos_lite: "i1f" }, Kind.INT),
+    f("bridge_priority", { swos: "prio", swos_lite: "i0e" }, Kind.INT),
+    f("port_cost_mode", { swos: "cost", swos_lite: "i0f" }, Kind.OPTION, {
+      options: ["short", "long"]
+    }),
+    f("root_bridge_priority", { swos_lite: "i10" }, Kind.INT),
+    f("root_bridge_mac", { swos_lite: "i11" }, Kind.MAC),
+    f("igmp_fast_leave", { swos: "igfl", swos_lite: "i27" }, Kind.BOOL),
+    f("igmp_version", { swos: "igve", swos_lite: "i28" }, Kind.OPTION, { options: ["v2", "v3"] }),
+    f("igmp_querier", { swos: "igmq", swos_lite: "i29" }, Kind.CHECKBOX),
+    f("fwd_reserved_mc", { swos: "frmc", swos_lite: "i2a" }, Kind.CHECKBOX),
+    f("cpu_temp", { swos_lite: "i22" }, Kind.INT, { signed: true, bits: 16, note: "deg C" }),
+    f("power_consumption", { swos_lite: "i26" }, Kind.INT, {
+      scale: 10,
+      note: "watts (switch itself, excl. PoE)"
+    })
+  ]
+};
+var POE = {
+  path: "poe.b",
+  fields: [
+    f("out", { swos_lite: "i01" }, Kind.OPTION, { options: POE_OUT, perPort: true }),
+    f("priority", { swos_lite: "i02" }, Kind.INT, {
+      perPort: true,
+      note: "wire = priority-1 (0..7 -> 1..8)"
+    }),
+    f("voltage_level", { swos_lite: "i03" }, Kind.OPTION, {
+      options: POE_VOLTAGE,
+      perPort: true
+    }),
+    f("state", { swos_lite: "i04" }, Kind.OPTION, { options: POE_STATE, perPort: true }),
+    f("current", { swos_lite: "i05" }, Kind.INT, { perPort: true, note: "mA" }),
+    f("voltage", { swos_lite: "i06" }, Kind.INT, { perPort: true, scale: 10, note: "volts" }),
+    f("power", { swos_lite: "i07" }, Kind.INT, { perPort: true, scale: 10, note: "watts" }),
+    f("total_raw", { swos_lite: "i08" }, Kind.INT, {
+      unknown: true,
+      note: "global PoE total (raw); semantics TBD"
+    }),
+    f("controller", { swos_lite: "i09" }, Kind.STR, {
+      unknown: true,
+      note: "PoE controller serial/fw string"
+    }),
+    f("lldp_enabled", { swos_lite: "i0a" }, Kind.CHECKBOX, {
+      unknown: true,
+      note: "global LLDP toggle (Lite); per-port in some firmwares"
+    }),
+    f("lldp_power", { swos_lite: "i0b" }, Kind.INT, {
+      perPort: true,
+      scale: 10,
+      unknown: true,
+      note: "per-port LLDP negotiated power"
+    })
+  ]
+};
+var LACP = {
+  path: "lacp.b",
+  fields: [
+    f("active", { swos_lite: "i01" }, Kind.INT, {
+      perPort: true,
+      note: "per-port LACP active/member flag (0/1)"
+    }),
+    f("trunk_id", { swos_lite: "i02" }, Kind.INT, {
+      perPort: true,
+      note: "static LAG / trunk id (observed 1, 2 and 3)"
+    }),
+    f("group", { swos_lite: "i03" }, Kind.INT, { perPort: true, note: "LAG group, engine max 15" }),
+    f("partner_mac", { swos_lite: "i04" }, Kind.MAC, {
+      perPort: true,
+      note: "LACP partner/peer MAC (same value for both members of a LAG)"
+    })
+  ]
+};
+var RSTP = {
+  path: "rstp.b",
+  fields: [
+    f("enabled", { swos: "ena", swos_lite: "i01" }, Kind.BOOL, {
+      note: "per-port RSTP-enabled mask (0x3ff = all)"
+    }),
+    f("role", { swos_lite: "i02" }, Kind.OPTION, {
+      options: RSTP_ROLE,
+      perPort: true,
+      note: "per-port RSTP role"
+    }),
+    f("root_path_cost", { swos_lite: "i03" }, Kind.INT, {
+      perPort: true,
+      note: "per-port root path cost (0 = auto)"
+    }),
+    f("unknown_i04", { swos_lite: "i04" }, Kind.INT, {
+      perPort: true,
+      unknown: true,
+      note: "observed 0/2/4/0x13; candidate = port priority / port number"
+    }),
+    f("mode_mask", { swos_lite: "i05" }, Kind.BOOL, {
+      unknown: true,
+      note: "0x3ff on this device; candidate = STP/RSTP mode mask"
+    }),
+    f("type_mask", { swos_lite: "i06" }, Kind.BOOL, {
+      unknown: true,
+      note: "0x3ff here; candidate = port type mask (paired with i07)"
+    }),
+    f("unknown_i07", { swos_lite: "i07" }, Kind.INT, {
+      unknown: true,
+      note: "0x324 here; paired mask for i06"
+    }),
+    f("forwarding", { swos_lite: "i08" }, Kind.BOOL, {
+      note: "forwarding-state mask (port4 down -> bit clear)"
+    }),
+    f("learning", { swos_lite: "i09" }, Kind.BOOL, {
+      note: "learning-state mask (port4 down -> bit clear)"
+    })
+  ]
+};
+var SNMP = {
+  path: "snmp.b",
+  fields: [
+    f("enabled", { swos: "en", swos_lite: "i01" }, Kind.CHECKBOX),
+    f("community", { swos: "com", swos_lite: "i02" }, Kind.STR),
+    f("contact", { swos: "ci", swos_lite: "i03" }, Kind.STR),
+    f("location", { swos: "loc", swos_lite: "i04" }, Kind.STR)
+  ]
+};
+var FWD = {
+  path: "fwd.b",
+  fields: [
+    ...Array.from(
+      { length: 10 },
+      (_, i) => f(
+        `isolation_p${i + 1}`,
+        { swos_lite: `i${(i + 1).toString(16).padStart(2, "0")}` },
+        Kind.BOOL,
+        {
+          note: "forwarding/isolation mask; bit n cleared"
+        }
+      )
+    ),
+    f("port_lock", { swos_lite: "i10" }, Kind.BOOL, {
+      perPort: true,
+      note: "port lock (disable learning)"
+    }),
+    f("lock_on_first", { swos_lite: "i11" }, Kind.BOOL, {
+      perPort: true,
+      note: "lock on first learned MAC"
+    }),
+    f("mirror_ingress", { swos_lite: "i12" }, Kind.BOOL, { perPort: true }),
+    f("mirror_egress", { swos_lite: "i13" }, Kind.BOOL, { perPort: true }),
+    f("mirror_to", { swos_lite: "i14" }, Kind.BOOL, {
+      perPort: true,
+      note: "egress mirror target port (scalar mask on this device)"
+    }),
+    f("vlan_mode", { swos_lite: "i15" }, Kind.OPTION, { options: VLAN_MODE, perPort: true }),
+    f("vlan_recv_mode", { swos_lite: "i17" }, Kind.OPTION, { options: VLAN_RECV, perPort: true }),
+    f("default_vid", { swos_lite: "i18" }, Kind.INT, {
+      perPort: true,
+      note: "default VLAN id per port"
+    }),
+    f("force_vid", { swos_lite: "i19" }, Kind.BOOL, { perPort: true, note: "force VLAN id" }),
+    f("storm_rate", { swos_lite: "i1a" }, Kind.INT, {
+      perPort: true,
+      scale: 1e5,
+      note: "storm limit (fraction of link)"
+    }),
+    f("limit_unknown_ucast", { swos_lite: "i1b" }, Kind.BOOL, {
+      perPort: true,
+      note: "limit unknown unicast"
+    }),
+    f("flood_unknown_mcast", { swos_lite: "i1c" }, Kind.BOOL, {
+      perPort: true,
+      note: "flood unknown multicast"
+    }),
+    f("ingress_rate", { swos_lite: "i1d" }, Kind.INT, {
+      perPort: true,
+      scale: 1e5,
+      note: "ingress rate limit (fraction of link)"
+    }),
+    f("egress_rate", { swos_lite: "i1e" }, Kind.INT, {
+      perPort: true,
+      scale: 1e5,
+      note: "egress rate limit (fraction of link)"
+    })
+  ]
+};
+var VLAN = {
+  path: "vlan.b",
+  isArray: true,
+  note: "SwOS Lite vlan.b keys unverified (device had none)",
+  fields: [
+    f("vid", { swos: "vid" }, Kind.INT),
+    f("name", { swos: "nm" }, Kind.STR),
+    f("port_isolation", { swos: "piso" }, Kind.CHECKBOX),
+    f("learning", { swos: "lrn" }, Kind.CHECKBOX),
+    f("mirror", { swos: "mrr" }, Kind.CHECKBOX),
+    f("igmp", { swos: "igmp" }, Kind.CHECKBOX),
+    f("members", { swos: "mbr" }, Kind.BOOL)
+  ]
+};
+var HOST = {
+  path: "host.b",
+  isArray: true,
+  note: "Static host table (device had none)",
+  fields: [
+    f("mac", { swos_lite: "i01" }, Kind.MAC),
+    f("port", { swos_lite: "i02" }, Kind.INT, {
+      note: "port id; 0x80 bit = SFP/combo, low nibble = 1-based port (interpretation unverified)"
+    })
+  ]
+};
+var DHOST = {
+  path: "!dhost.b",
+  isArray: true,
+  note: "Dynamically learned MAC table",
+  fields: HOST.fields
+};
+var IGMP = {
+  path: "!igmp.b",
+  isArray: true,
+  note: "IGMP snooping groups (device had none)",
+  fields: [
+    f("group_address", { swos_lite: "i01" }, Kind.INT, { note: "multicast group IP (raw int)" }),
+    f("member_ports", { swos_lite: "i02" }, Kind.BOOL, { note: "per-port membership bitmask" }),
+    f("vlan", { swos_lite: "i03" }, Kind.INT, { note: "VLAN id" })
+  ]
+};
+var ACL = {
+  path: "acl.b",
+  isArray: true,
+  note: "ACL rules (device had none)",
+  fields: [
+    f("from", { swos_lite: "i01" }, Kind.BOOL, { note: "source port bitmask" }),
+    f("mac_src", { swos_lite: "i02" }, Kind.MAC),
+    f("mac_src_mask", { swos_lite: "i03" }, Kind.MAC),
+    f("mac_dst", { swos_lite: "i04" }, Kind.MAC),
+    f("mac_dst_mask", { swos_lite: "i05" }, Kind.MAC),
+    f("ethertype", { swos_lite: "i06" }, Kind.INT),
+    f("vlan_present", { swos_lite: "i07" }, Kind.OPTION, { options: ACL_VLAN_PRESENT }),
+    f("vlan_id", { swos_lite: "i08" }, Kind.INT),
+    f("priority", { swos_lite: "i09" }, Kind.INT),
+    f("ip_src", { swos_lite: "i0a" }, Kind.INT, { note: "source IP (raw int)" }),
+    f("ip_src_mask_hi", { swos_lite: "i0b" }, Kind.INT),
+    f("ip_src_mask_lo", { swos_lite: "i0c" }, Kind.INT),
+    f("ip_dst", { swos_lite: "i0d" }, Kind.INT, { note: "dest IP (raw int)" }),
+    f("ip_dst_mask_hi", { swos_lite: "i0e" }, Kind.INT),
+    f("ip_dst_mask_lo", { swos_lite: "i0f" }, Kind.INT),
+    f("protocol", { swos_lite: "i10" }, Kind.INT),
+    f("dscp", { swos_lite: "i11" }, Kind.INT),
+    f("drop", { swos_lite: "i12" }, Kind.CHECKBOX, { note: "drop matching packets" }),
+    f("mirror_to", { swos_lite: "i13" }, Kind.OPTION, { note: "egress port / off" }),
+    f("redirect_to", { swos_lite: "i14" }, Kind.OPTION, { note: "egress port / off" }),
+    f("set_vlan_id", { swos_lite: "i15" }, Kind.INT),
+    f("set_priority", { swos_lite: "i16" }, Kind.INT),
+    f("set_dscp", { swos_lite: "i17" }, Kind.INT),
+    f("account_as", { swos_lite: "i18" }, Kind.OPTION, { options: ACL_ACCOUNT_AS })
+  ]
+};
+var ACLSTATS = {
+  path: "!aclstats.b",
+  fields: [
+    f("counter_1", { swos_lite: "i01" }, Kind.INT, { perPort: true }),
+    f("counter_2", { swos_lite: "i02" }, Kind.INT, { perPort: true }),
+    f("counter_3", { swos_lite: "i03" }, Kind.INT, { perPort: true }),
+    f("counter_4", { swos_lite: "i04" }, Kind.INT, { perPort: true })
+  ]
+};
+var SFP = {
+  path: "sfp.b",
+  note: "per-cage SFP DOM diagnostics (text fields are UTF-8 over hex)",
+  fields: [
+    f("vendor", { swos_lite: "i01" }, Kind.STR, { perPort: true }),
+    f("part_number", { swos_lite: "i02" }, Kind.STR, { perPort: true }),
+    f("revision", { swos_lite: "i03" }, Kind.STR, { perPort: true }),
+    f("serial", { swos_lite: "i04" }, Kind.STR, { perPort: true }),
+    f("date", { swos_lite: "i05" }, Kind.STR, { perPort: true }),
+    f("type", { swos_lite: "i06" }, Kind.STR, { perPort: true, note: "xa:1 = hex-ascii" }),
+    f("diag_extra", { swos_lite: "i07" }, Kind.INT, {
+      perPort: true,
+      unknown: true,
+      note: "firmware-specific raw value (85000 on the populated cage); purpose unconfirmed"
+    }),
+    // Signed like sys.b cpu_temp. A cage with no DOM (passive copper DAC)
+    // reports 0xff80 -> -128, which reads as "no reading" rather than 65408.
+    f("temperature", { swos_lite: "i08" }, Kind.INT, {
+      perPort: true,
+      signed: true,
+      bits: 16,
+      note: "deg C; -128 = no DOM data (e.g. passive DAC)"
+    }),
+    f("voltage", { swos_lite: "i09" }, Kind.INT, { perPort: true, scale: 1e3, note: "volts" }),
+    f("tx_bias", { swos_lite: "i0a" }, Kind.INT, { perPort: true, note: "mA" }),
+    f("tx_power", { swos_lite: "i0b" }, Kind.INT, { perPort: true, scale: 1e4, note: "dBm" }),
+    f("rx_power", { swos_lite: "i0c" }, Kind.INT, { perPort: true, scale: 1e4, note: "dBm" })
+  ]
+};
+var STATS = {
+  path: "!stats.b",
+  fields: [],
+  genericPerPort: true,
+  note: "Per-port cumulative counters (rx/tx bytes, packets, errors, drops...). iNN keys preserved as-is."
+};
+var STATS_METRICS = {
+  i01: "rx_bytes",
+  i0f: "tx_bytes",
+  i05: "rx_unicasts",
+  i11: "tx_unicasts",
+  i07: "rx_broadcasts",
+  i14: "tx_broadcasts",
+  i08: "rx_multicasts",
+  i13: "tx_multicasts",
+  i23: "rx_total_packets",
+  i24: "tx_total_packets",
+  i21: "rx_rate",
+  i22: "tx_rate",
+  i25: "rx_packet_rate",
+  i26: "tx_packet_rate",
+  i17: "rx_pauses",
+  i1d: "rx_errors",
+  i1e: "rx_fcs_errors",
+  i1c: "rx_jabber",
+  i19: "rx_runt",
+  i1a: "rx_fragments",
+  i1b: "rx_too_long",
+  i16: "tx_pauses",
+  i04: "tx_fcs_errors",
+  i1f: "tx_collisions",
+  i15: "tx_single_collisions",
+  i18: "tx_multiple_collisions",
+  i12: "tx_excessive_collisions",
+  i20: "tx_late_collisions",
+  i06: "tx_deferred",
+  i09: "pkt_64",
+  i0a: "pkt_65_127",
+  i0b: "pkt_128_255",
+  i0c: "pkt_256_511",
+  i0d: "pkt_512_1023",
+  i0e: "pkt_1024_max"
+};
+var SWOS_SCHEMA = {
+  "link.b": LINK,
+  "sys.b": SYS,
+  "poe.b": POE,
+  "lacp.b": LACP,
+  "rstp.b": RSTP,
+  "snmp.b": SNMP,
+  "fwd.b": FWD,
+  "vlan.b": VLAN,
+  // Only the "!" form exists on the device; a plain /stats.b 303s to /index.html.
+  "!stats.b": STATS,
+  "sfp.b": SFP,
+  "host.b": HOST,
+  "!dhost.b": DHOST,
+  "!igmp.b": IGMP,
+  "acl.b": ACL,
+  "!aclstats.b": ACLSTATS
+};
+var SWOS_ENDPOINTS = Object.keys(SWOS_SCHEMA).sort();
+var VERIFIED_FIRMWARE = [
+  { model: "CSS610-8P-2S+", version: "2.21" }
+];
+var verifiedList = () => VERIFIED_FIRMWARE.map((v) => `${v.model} ${v.version}`).join(", ");
+function firmwareSupport(model, version) {
+  const m = typeof model === "string" ? model : void 0;
+  const v = typeof version === "string" ? version : void 0;
+  if (m === void 0 || v === void 0) {
+    return {
+      model: m,
+      version: v,
+      verified: false,
+      note: `Firmware could not be identified; the schema is verified against ${verifiedList()}.`
+    };
   }
-  const currentByKey = new Map(current.map((r) => [semanticKey(r, keys), r]));
-  const beforeByKey = new Map(before.map((r) => [semanticKey(r, keys), r]));
-  const toCreate = [];
-  const toUpdate = [];
-  for (const [key2, beforeRecord] of beforeByKey) {
-    const currentRecord = currentByKey.get(key2);
-    if (!currentRecord) {
-      toCreate.push(beforeRecord);
-    } else if (!recordsAreEqual(beforeRecord, currentRecord)) {
-      const { ".id": _, ...data } = beforeRecord;
-      toUpdate.push({ currentId: currentRecord[".id"], data });
-    }
+  if (VERIFIED_FIRMWARE.some((entry) => entry.model === m && entry.version === v)) {
+    return {
+      model: m,
+      version: v,
+      verified: true,
+      note: `${m} ${v} \u2014 schema verified on this firmware.`
+    };
   }
-  const toRemove = current.filter((r) => !beforeByKey.has(semanticKey(r, keys))).map((r) => r[".id"]);
-  return applyUserRestriction(path, { path, toCreate, toRemove, toUpdate, warnings });
+  const sameModel = VERIFIED_FIRMWARE.filter((entry) => entry.model === m).map((e) => e.version);
+  return {
+    model: m,
+    version: v,
+    verified: false,
+    note: sameModel.length > 0 ? `${m} runs ${v}; the schema was verified on ${sameModel.join(", ")}. Field meanings may have changed \u2014 review the diff before applying.` : `${m} ${v} is not in the verified set (${verifiedList()}). Field meanings are inferred \u2014 review the diff before applying.`
+  };
 }
-async function applyRestorePlan(plan, client) {
-  for (const id of plan.toRemove) {
-    await client.remove(plan.path, id);
-  }
-  for (const record of plan.toCreate) {
-    const { ".id": _, ...data } = record;
-    await client.create(plan.path, data);
-  }
-  for (const { currentId, data } of plan.toUpdate) {
-    await client.update(plan.path, currentId, data);
+function unmappedWireKeys(endpoint, wire) {
+  const ep = SWOS_SCHEMA[endpoint];
+  if (!ep || ep.isArray || ep.genericPerPort) return [];
+  const mapped = new Set(ep.fields.map((field) => selectKey(field, wire)));
+  return Object.keys(wire).filter((key2) => !mapped.has(key2));
+}
+function inferPortCount(data) {
+  for (const v of Object.values(data)) {
+    if (Array.isArray(v) && v.length > 0 && !Array.isArray(v[0]) && typeof v[0] !== "object") {
+      return v.length;
+    }
+  }
+  return 0;
+}
+function inferPortCountFromMasks(ep, data) {
+  let widest = 0;
+  for (const fieldDef of ep.fields) {
+    if (fieldDef.kind !== Kind.BOOL) continue;
+    const key2 = selectKey(fieldDef, data);
+    const value = key2 === void 0 ? void 0 : data[key2];
+    if (typeof value === "number" && value > 0) {
+      widest = Math.max(widest, value.toString(2).length);
+    }
+  }
+  return widest;
+}
+function selectKey(fieldDef, data) {
+  return Object.values(fieldDef.keys).find((key2) => key2 in data);
+}
+function hexToBoolList(value, length) {
+  const bits = value.toString(2).padStart(length, "0").split("").reverse().map((b) => b === "1");
+  return bits.slice(0, length);
+}
+function decodeScalar(fieldDef, value, portCount) {
+  switch (fieldDef.kind) {
+    case Kind.BOOL:
+      return hexToBoolList(value, portCount);
+    case Kind.STR: {
+      const hex = value;
+      const buf = Buffer.from(hex.length % 2 ? `0${hex}` : hex, "hex");
+      return buf.toString("utf8").replace(/[\0\s]+$/g, "");
+    }
+    case Kind.OPTION: {
+      const idx = value;
+      return fieldDef.options && idx < fieldDef.options.length ? fieldDef.options[idx] : idx;
+    }
+    case Kind.MAC:
+      return value.toUpperCase().match(/../g)?.join(":") ?? "";
+    case Kind.IP:
+      if (!value) return "0.0.0.0";
+      return Buffer.from(value.toString(16).padStart(8, "0"), "hex").reverse().join(".");
+    case Kind.CHECKBOX:
+      return value === 1;
+    case Kind.INT: {
+      let num = value;
+      if (fieldDef.signed && fieldDef.bits) {
+        const half = 1 << fieldDef.bits - 1;
+        if (num >= half) num -= 1 << fieldDef.bits;
+      }
+      return fieldDef.scale ? num / fieldDef.scale : num;
+    }
+    default:
+      return value;
+  }
+}
+function decodeObject(ep, data) {
+  const portCount = inferPortCount(data) || inferPortCountFromMasks(ep, data);
+  const out = {};
+  const knownKeys = /* @__PURE__ */ new Set();
+  for (const fieldDef of ep.fields) {
+    const key2 = selectKey(fieldDef, data);
+    if (key2 === void 0) continue;
+    knownKeys.add(key2);
+    const v = data[key2];
+    if (fieldDef.perPort || fieldDef.kind === Kind.BOOL) {
+      out[fieldDef.name] = Array.isArray(v) ? v.map((x) => decodeScalar(fieldDef, x, portCount)) : decodeScalar(fieldDef, v, portCount);
+    } else {
+      out[fieldDef.name] = decodeScalar(fieldDef, v, portCount);
+    }
   }
+  out["_raw"] = Object.fromEntries(Object.entries(data).filter(([k]) => !knownKeys.has(k)));
+  return out;
 }
-
-// src/domain/snapshot/snapshot-engine.ts
-function pathToSlug(rosPath) {
-  return rosPath.replace(/\//g, "-");
-}
-function timestampPrefix() {
-  return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 15);
+function decodeRecords(ep, data) {
+  return data.map((item) => {
+    const row = {};
+    const itemObj = item;
+    const knownKeys = /* @__PURE__ */ new Set();
+    for (const fieldDef of ep.fields) {
+      const key2 = selectKey(fieldDef, itemObj);
+      if (key2 === void 0) continue;
+      knownKeys.add(key2);
+      row[fieldDef.name] = decodeScalar(fieldDef, itemObj[key2], 0);
+    }
+    row["_raw"] = Object.fromEntries(Object.entries(itemObj).filter(([k]) => !knownKeys.has(k)));
+    return row;
+  });
 }
-async function takeSnapshot(client, routerId2, path, snapshotDir) {
-  const records = normalizeForDiff(await client.get(path, {}));
-  const id = `${timestampPrefix()}-${pathToSlug(path)}-${nanoid(6)}`;
-  const dir = join2(snapshotDir, routerId2);
-  const filePath = join2(dir, `${id}.json`);
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  await mkdir(dir, { recursive: true });
-  const stored = { id, routerId: routerId2, path, ts, records };
-  await writeFile(filePath, JSON.stringify(stored, null, 2));
-  return { id, routerId: routerId2, path, ts, filePath, recordCount: records.length };
+function decodeGenericPerPort(data) {
+  const portCount = inferPortCount(data);
+  const ports = {};
+  for (let n = 1; n <= portCount; n++) ports[String(n)] = {};
+  const scalars = {};
+  for (const [k, v] of Object.entries(data)) {
+    if (Array.isArray(v) && v.length === portCount && !Array.isArray(v[0]) && typeof v[0] !== "object") {
+      for (let n = 0; n < portCount; n++) {
+        const port = ports[String(n + 1)];
+        port[k] = v[n];
+        if (STATS_METRICS[k]) port[STATS_METRICS[k]] = v[n];
+      }
+    } else {
+      scalars[k] = v;
+    }
+  }
+  ports["_scalars"] = scalars;
+  return ports;
 }
-async function loadSnapshot(filePath) {
-  return JSON.parse(await readFile(filePath, "utf-8"));
+function decodeEndpoint(path, rawText) {
+  const ep = SWOS_SCHEMA[path];
+  if (!ep) throw new Error(`no SwOS schema for ${path}`);
+  const data = parseBlob(rawText);
+  if (ep.isArray) return decodeRecords(ep, data);
+  if (ep.genericPerPort) return decodeGenericPerPort(data);
+  return decodeObject(ep, data);
 }
 
-// src/domain/snapshot/write-journal.ts
-import { appendFile as appendFile2, mkdir as mkdir2 } from "fs/promises";
-import { dirname } from "path";
-import { nanoid as nanoid2 } from "nanoid";
+// src/adapter/rest-client.ts
+import { request, Agent as Agent2 } from "undici";
 
-// src/observability/audit-log.ts
-import { appendFile } from "fs/promises";
-var log22 = createLogger("audit");
-var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
-  "password",
-  "pass",
-  "token",
-  "secret",
-  "authorization",
-  "credentials",
-  "privatekey",
-  "presharedkey",
-  "psk",
-  "passphrase",
-  "community",
-  "apikey",
-  "confirmationsecret"
-]);
-function redactValue(value) {
-  if (Array.isArray(value)) {
-    return value.map(redactValue);
-  }
-  if (value !== null && typeof value === "object") {
-    return redactParams(value);
-  }
-  return value;
+// src/adapter/tls-manager.ts
+import { readFileSync } from "fs";
+import { buildConnector } from "undici";
+function makePinnedConnector(inner, expectedFingerprint) {
+  const expected = expectedFingerprint.replace(/:/g, "").toLowerCase();
+  return (opts, cb) => {
+    inner(opts, (err, socket) => {
+      if (err || !socket) {
+        cb(err ?? new Error("TLS connection failed"), null);
+        return;
+      }
+      const peer = socket;
+      const cert = typeof peer.getPeerCertificate === "function" ? peer.getPeerCertificate() : void 0;
+      const actual = (cert?.fingerprint256 ?? "").replace(/:/g, "").toLowerCase();
+      if (actual !== expected) {
+        socket.destroy();
+        cb(
+          new Error(
+            `TLS certificate fingerprint mismatch. Expected: ${expected}, got: ${actual || "none"}`
+          ),
+          null
+        );
+        return;
+      }
+      cb(null, socket);
+    });
+  };
+}
+function buildAgentOptions(tls) {
+  if (!tls.enabled) {
+    return {};
+  }
+  const connectOptions = {
+    rejectUnauthorized: tls.rejectUnauthorized
+  };
+  if (tls.ca) {
+    connectOptions.ca = readFileSync(tls.ca, "utf-8");
+  }
+  if (tls.fingerprint) {
+    const inner = buildConnector(connectOptions);
+    return { connect: makePinnedConnector(inner, tls.fingerprint) };
+  }
+  return {
+    connect: connectOptions
+  };
+}
+
+// src/adapter/query-builder.ts
+function buildListQuery(options) {
+  if (!options) {
+    return { method: "GET" };
+  }
+  const hasFilter = options.filter && Object.keys(options.filter).length > 0;
+  const hasProplist = options.proplist && options.proplist.length > 0;
+  if (hasProplist) {
+    const body = {};
+    if (hasProplist) {
+      body[".proplist"] = options.proplist.join(",");
+    }
+    if (hasFilter) {
+      const queryParts = [];
+      for (const [key2, value] of Object.entries(options.filter)) {
+        queryParts.push(`${key2}=${value}`);
+      }
+      body[".query"] = queryParts;
+    }
+    return { method: "POST", body };
+  }
+  if (hasFilter) {
+    const queryParams = {};
+    for (const [key2, value] of Object.entries(options.filter)) {
+      queryParams[key2] = value;
+    }
+    return { method: "GET", queryParams };
+  }
+  return { method: "GET" };
+}
+function applyPagination(items, limit2, offset2) {
+  const total = items.length;
+  const start = offset2 ?? 0;
+  const sliced = limit2 !== void 0 ? items.slice(start, start + limit2) : items.slice(start);
+  return {
+    items: sliced,
+    total,
+    hasMore: start + sliced.length < total
+  };
+}
+
+// src/adapter/rest-client.ts
+var HttpError = class extends Error {
+  statusCode;
+  responseBody;
+  constructor(statusCode, responseBody) {
+    super(`HTTP ${statusCode}: ${responseBody}`);
+    this.name = "HttpError";
+    this.statusCode = statusCode;
+    this.responseBody = responseBody;
+  }
+};
+var REQUEST_TIMEOUT_MS = 3e4;
+var RouterOSRestClient = class {
+  baseUrl;
+  authHeader;
+  agent;
+  constructor(config, credentials) {
+    const scheme = config.tls.enabled ? "https" : "http";
+    this.baseUrl = `${scheme}://${config.host}:${config.port}/rest`;
+    this.authHeader = "Basic " + Buffer.from(`${credentials.username}:${credentials.password}`).toString("base64");
+    this.agent = new Agent2(buildAgentOptions(config.tls));
+  }
+  // ---------- public CRUD methods ----------
+  /**
+   * List resources at the given path.
+   *
+   * Applies filtering via GET query params or POST body depending on the
+   * query complexity, then runs client-side pagination.
+   */
+  async get(path, options) {
+    const query = buildListQuery(options);
+    let raw;
+    if (query.method === "POST") {
+      raw = await this.doRequest("POST", `${this.baseUrl}/${path}`, query.body);
+    } else {
+      const qs = query.queryParams ? "?" + new URLSearchParams(query.queryParams).toString() : "";
+      raw = await this.doRequest("GET", `${this.baseUrl}/${path}${qs}`);
+    }
+    const rawArray = Array.isArray(raw) ? raw : [raw];
+    const parsed = parseRecords(rawArray);
+    if (options?.limit !== void 0 || options?.offset !== void 0) {
+      const page = applyPagination(parsed, options?.limit, options?.offset);
+      return page.items;
+    }
+    return parsed;
+  }
+  /** Fetch a single resource by its RouterOS `.id`. */
+  async getOne(path, id) {
+    const raw = await this.doRequest("GET", `${this.baseUrl}/${path}/${id}`);
+    return parseRecord(raw);
+  }
+  /** Create a new resource (PUT). Returns the created record including `.id`. */
+  async create(path, data) {
+    const raw = await this.doRequest("PUT", `${this.baseUrl}/${path}`, data);
+    return raw;
+  }
+  /** Update an existing resource by `.id` (PATCH). */
+  async update(path, id, data) {
+    await this.doRequest("PATCH", `${this.baseUrl}/${path}/${id}`, data);
+  }
+  /** Remove a resource by `.id` (DELETE). */
+  async remove(path, id) {
+    await this.doRequest("DELETE", `${this.baseUrl}/${path}/${id}`);
+  }
+  /** Execute a command (POST), e.g. `/ip/firewall/filter/print`. */
+  async execute(path, data) {
+    const result = await this.doRequest("POST", `${this.baseUrl}/${path}`, data);
+    return result;
+  }
+  // ---------- lifecycle ----------
+  /** Close the underlying HTTP agent and free resources. */
+  close() {
+    this.agent.close();
+  }
+  // ---------- internal ----------
+  /**
+   * Core HTTP request method.
+   *
+   * - Sends JSON body when provided.
+   * - Attaches Basic Auth and content-type headers.
+   * - Throws `HttpError` on non-2xx status codes.
+   * - Returns parsed JSON (or `undefined` for empty bodies).
+   */
+  async doRequest(method, url, body) {
+    const headers = {
+      Accept: "application/json",
+      Authorization: this.authHeader
+    };
+    let requestBody;
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      requestBody = JSON.stringify(body);
+    }
+    const response = await request(url, {
+      method,
+      headers,
+      body: requestBody,
+      dispatcher: this.agent,
+      bodyTimeout: REQUEST_TIMEOUT_MS,
+      headersTimeout: REQUEST_TIMEOUT_MS
+    });
+    const text = await response.body.text();
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throw new HttpError(response.statusCode, text);
+    }
+    if (!text || text.length === 0) {
+      return void 0;
+    }
+    return JSON.parse(text);
+  }
+};
+
+// src/adapter/swos-client.ts
+var REQUEST_TIMEOUT_MS2 = 15e3;
+function md5(input2) {
+  return createHash("md5").update(input2).digest("hex");
+}
+function parseDigestChallenge(header) {
+  if (!header.toLowerCase().startsWith("digest")) return void 0;
+  const fields = {};
+  const quoted = /([a-zA-Z0-9_-]+)\s*=\s*("([^"]*)"|([^\s,]+))/g;
+  let m;
+  while ((m = quoted.exec(header)) !== null) {
+    fields[m[1]] = m[3] ?? m[4];
+  }
+  if (!fields.realm || !fields.nonce) return void 0;
+  return {
+    realm: fields.realm,
+    nonce: fields.nonce,
+    opaque: fields.opaque,
+    qop: fields.qop,
+    algorithm: fields.algorithm
+  };
+}
+function buildDigestHeader(method, path, challenge, credentials, nonceCount) {
+  const ha1 = md5(`${credentials.username}:${challenge.realm}:${credentials.password}`);
+  const ha2 = md5(`${method}:${path}`);
+  const nc = nonceCount.toString(16).padStart(8, "0");
+  const cnonce = randomBytes(8).toString("hex");
+  const qop = challenge.qop?.split(",").map((s) => s.trim()).find((s) => s === "auth");
+  const response = qop ? md5(`${ha1}:${challenge.nonce}:${nc}:${cnonce}:${qop}:${ha2}`) : md5(`${ha1}:${challenge.nonce}:${ha2}`);
+  const parts = [
+    `username="${credentials.username}"`,
+    `realm="${challenge.realm}"`,
+    `nonce="${challenge.nonce}"`,
+    `uri="${path}"`,
+    `response="${response}"`
+  ];
+  if (challenge.algorithm) parts.push(`algorithm=${challenge.algorithm}`);
+  if (challenge.opaque) parts.push(`opaque="${challenge.opaque}"`);
+  if (qop) parts.push(`qop=${qop}`, `nc=${nc}`, `cnonce="${cnonce}"`);
+  return `Digest ${parts.join(", ")}`;
+}
+function assertKnownEndpoint(endpoint) {
+  if (endpoint in SWOS_SCHEMA) return;
+  throw new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code: "SWOS_UNKNOWN_ENDPOINT",
+    message: `No SwOS schema for "${endpoint}".`,
+    details: { endpoint, known: Object.keys(SWOS_SCHEMA) },
+    recoverability: {
+      retryable: false,
+      suggestedAction: "Call list_swos_endpoints to see the supported endpoints."
+    }
+  });
+}
+var SwosClient = class {
+  host;
+  port;
+  credentials;
+  requestTimeoutMs;
+  challenge;
+  nonceCount = 0;
+  constructor(host, port, credentials, requestTimeoutMs = REQUEST_TIMEOUT_MS2) {
+    this.host = host;
+    this.port = port;
+    this.credentials = credentials;
+    this.requestTimeoutMs = requestTimeoutMs;
+  }
+  // ---------- raw transport ----------
+  /**
+   * Uses `node:http` with `insecureHTTPParser` rather than undici, because the
+   * SwOS firmware terminates the status line of a POST response with a bare LF
+   * instead of CRLF ("HTTP/1.0 200 OK\n"). A strict parser rejects that, which
+   * would report a write that actually succeeded as a failure. The leniency is
+   * scoped to this client — the RouterOS REST client keeps the strict parser.
+   */
+  rawRequest(method, path, headers, body) {
+    return new Promise((resolve, reject) => {
+      const req = httpRequest(
+        {
+          host: this.host,
+          port: this.port,
+          path,
+          method,
+          headers,
+          insecureHTTPParser: true
+        },
+        (res) => {
+          res.setEncoding("utf8");
+          let data = "";
+          res.on("data", (chunk) => data += chunk);
+          res.on(
+            "end",
+            () => resolve({ statusCode: res.statusCode ?? 0, headers: res.headers, body: data })
+          );
+          res.on("error", reject);
+        }
+      );
+      req.on("error", reject);
+      req.setTimeout(this.requestTimeoutMs, () => {
+        const isWrite = method === "POST";
+        req.destroy(
+          new MikroMCPError({
+            category: "ROUTER_TIMEOUT" /* ROUTER_TIMEOUT */,
+            code: "SWOS_REQUEST_TIMEOUT",
+            message: `SwOS ${method} request to ${path} timed out after ${this.requestTimeoutMs}ms${isWrite ? " \u2014 the write may still have been applied" : ""}`,
+            recoverability: isWrite ? {
+              retryable: false,
+              suggestedAction: "SwOS firmware does not acknowledge writes, so a longer timeout will not help."
+            } : {
+              retryable: true,
+              retryAfterMs: 3e3,
+              suggestedAction: "The switch did not respond in time \u2014 retry the read."
+            }
+          })
+        );
+      });
+      if (body !== void 0) req.write(body);
+      req.end();
+    });
+  }
+  async doRequest(method, path, body) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const headers = {
+        Accept: "text/plain",
+        "Accept-Encoding": "identity"
+      };
+      if (body !== void 0) {
+        headers["Content-Type"] = "text/plain";
+        headers["Content-Length"] = Buffer.byteLength(body);
+      }
+      if (this.challenge) {
+        this.nonceCount += 1;
+        headers["Authorization"] = buildDigestHeader(
+          method,
+          path,
+          this.challenge,
+          this.credentials,
+          this.nonceCount
+        );
+      }
+      const response = await this.rawRequest(method, path, headers, body);
+      const rawChallengeHeader = response.headers["www-authenticate"];
+      const rawChallenge = Array.isArray(rawChallengeHeader) ? rawChallengeHeader[0] : rawChallengeHeader;
+      if (response.statusCode === 401 && rawChallenge) {
+        const parsed = parseDigestChallenge(rawChallenge);
+        if (parsed) {
+          this.challenge = parsed;
+          this.nonceCount = 0;
+          continue;
+        }
+      }
+      if (response.statusCode < 200 || response.statusCode >= 300) {
+        throw new HttpError(response.statusCode, response.body);
+      }
+      return response.body;
+    }
+    throw new HttpError(401, "digest authentication failed");
+  }
+  /** GET a .b endpoint, return the raw broken-JSON text. */
+  async getRaw(endpoint) {
+    return this.doRequest("GET", `/${endpoint}`);
+  }
+  /** POST a re-encoded .b blob back to the switch. */
+  async postRaw(endpoint, body) {
+    return this.doRequest("POST", `/${endpoint}`, body);
+  }
+  // ---------- decoded helpers ----------
+  /** GET + decode into the schema. Unknown keys are preserved under `_raw`. */
+  async get(endpoint) {
+    assertKnownEndpoint(endpoint);
+    return decodeEndpoint(endpoint, await this.getRaw(endpoint));
+  }
+  /**
+   * GET and parse into a plain wire dict for local mutation. Hex tokens keep
+   * their verbatim `"0x…"` form so untouched fields re-serialize byte-for-byte.
+   */
+  async readBlob(endpoint) {
+    assertKnownEndpoint(endpoint);
+    return parseWireBlob(await this.getRaw(endpoint));
+  }
+  /**
+   * GET for mutation, proving the codec is lossless for *this* device first.
+   * The fixtures only prove it for the hardware they came from; a firmware that
+   * serializes differently must fail here rather than during a whole-blob write.
+   */
+  async readBlobForWrite(endpoint) {
+    assertKnownEndpoint(endpoint);
+    const raw = await this.getRaw(endpoint);
+    const wire = parseWireBlob(raw);
+    const reencoded = dumpBlob(wire);
+    if (reencoded !== raw.trim()) {
+      throw new MikroMCPError({
+        category: "VALIDATION" /* VALIDATION */,
+        code: "SWOS_ROUNDTRIP_MISMATCH",
+        message: `MikroMCP cannot re-encode ${endpoint} on this device byte-for-byte; refusing to write.`,
+        details: { endpoint, received: raw.trim(), reencoded },
+        recoverability: {
+          retryable: false,
+          suggestedAction: "This firmware serializes a value in a form the codec does not preserve. Reads are unaffected; please open an issue with the blob."
+        }
+      });
+    }
+    return wire;
+  }
+  /** POST a wire dict (re-encoded via the codec) back to the switch. */
+  async writeBlob(endpoint, wire) {
+    assertKnownEndpoint(endpoint);
+    return this.postRaw(endpoint, dumpBlob(wire));
+  }
+  /** No-op; SwOS uses plain HTTP with per-request connections. */
+  close() {
+  }
+};
+
+// src/domain/snapshot/diff-engine.ts
+var RUNTIME_FIELDS = /* @__PURE__ */ new Set([
+  "bytes",
+  "packets",
+  "dynamic",
+  "invalid",
+  "dead",
+  "expired",
+  "active",
+  "running",
+  "about",
+  ".about",
+  ".nextid",
+  "creation-time",
+  "last-logged-in",
+  "last-link-up-time",
+  "last-link-down-time",
+  "link-downs",
+  "rx-byte",
+  "tx-byte",
+  "rx-packet",
+  "tx-packet",
+  "uptime"
+]);
+var ORDER_SENSITIVE_PATHS = /* @__PURE__ */ new Set([
+  "ip/firewall/filter",
+  "ip/firewall/nat",
+  "ip/firewall/mangle",
+  "routing/rule"
+]);
+function normalizeForDiff(records) {
+  const out = [];
+  for (const r of records) {
+    if (isTrue(r.dynamic)) continue;
+    const clean = {};
+    for (const [k, v] of Object.entries(r)) {
+      if (!RUNTIME_FIELDS.has(k)) clean[k] = v;
+    }
+    out.push(clean);
+  }
+  return out;
+}
+var SEMANTIC_KEYS = {
+  "ip/route": ["dst-address", "gateway", "routing-table"],
+  "ip/firewall/filter": ["comment"],
+  "ip/firewall/nat": ["comment"],
+  "ip/firewall/mangle": ["comment"],
+  "ip/firewall/address-list": ["list", "address"],
+  "ip/address": ["address", "interface"],
+  "ip/dns/static": ["name", "type"],
+  "routing/rule": ["src-address", "routing-table"],
+  "routing/table": ["name"],
+  "interface/wireguard/peers": ["public-key"],
+  "interface/bridge": ["name"],
+  "interface/bridge/port": ["bridge", "interface"],
+  "system/scheduler": ["name"],
+  "system/script": ["name"],
+  "system/package": ["name"],
+  "container": ["name"],
+  "certificate": ["name"],
+  "file": ["name"],
+  "interface/vrrp": ["name"],
+  "ip/dhcp-server": ["name"],
+  "ip/ipsec/peer": ["name"],
+  "ip/pool": ["name"],
+  "queue/simple": ["name"],
+  "tool/netwatch": ["host"],
+  "user": ["name"]
+};
+function normalizeValue(v) {
+  if (v === true || v === "true" || v === "yes") return "true";
+  if (v === false || v === "false" || v === "no") return "false";
+  return String(v ?? "");
+}
+function semanticKey(record, keys) {
+  return keys.map((k) => normalizeValue(record[k] ?? "")).join("|");
+}
+function recordSignature(record) {
+  return Object.entries(record).filter(([k]) => k !== ".id").sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}=${normalizeValue(v)}`).join(";");
+}
+function recordsAreEqual(a, b) {
+  const keysA = Object.keys(a).filter((k) => k !== ".id");
+  const keysB = Object.keys(b).filter((k) => k !== ".id");
+  if (keysA.length !== keysB.length) return false;
+  return keysA.every((k) => normalizeValue(a[k]) === normalizeValue(b[k] ?? ""));
+}
+function hasDuplicateKeys(records, keys) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    const k = semanticKey(r, keys);
+    if (seen.has(k)) return true;
+    seen.add(k);
+  }
+  return false;
+}
+function applyUserRestriction(path, plan) {
+  if (path === "user" && plan.toCreate.length > 0) {
+    plan.warnings.push(
+      `Refusing to recreate ${plan.toCreate.length} deleted user(s): passwords are not stored in snapshots and recreation would produce password-less logins. Recreate manually with manage_user.`
+    );
+    plan.toCreate = [];
+  }
+  return plan;
+}
+function computeRestorePlan(path, beforeRaw, currentRaw) {
+  const before = normalizeForDiff(beforeRaw);
+  const current = normalizeForDiff(currentRaw);
+  const warnings = [];
+  if (ORDER_SENSITIVE_PATHS.has(path)) {
+    warnings.push(
+      `Restored entries for ${path} are re-created at the end of the list \u2014 rule ORDER is not restored. Review ordering manually after rollback.`
+    );
+  }
+  const keys = SEMANTIC_KEYS[path];
+  const canUseKeys = keys !== void 0 && !hasDuplicateKeys(before, keys) && !hasDuplicateKeys(current, keys);
+  if (!canUseKeys) {
+    const beforeSigs = new Set(before.map(recordSignature));
+    const currentSigs = new Set(current.map(recordSignature));
+    return applyUserRestriction(path, {
+      path,
+      toCreate: before.filter((r) => !currentSigs.has(recordSignature(r))),
+      toRemove: current.filter((r) => !beforeSigs.has(recordSignature(r))).map((r) => r[".id"]),
+      toUpdate: [],
+      warnings
+    });
+  }
+  const currentByKey = new Map(current.map((r) => [semanticKey(r, keys), r]));
+  const beforeByKey = new Map(before.map((r) => [semanticKey(r, keys), r]));
+  const toCreate = [];
+  const toUpdate = [];
+  for (const [key2, beforeRecord] of beforeByKey) {
+    const currentRecord = currentByKey.get(key2);
+    if (!currentRecord) {
+      toCreate.push(beforeRecord);
+    } else if (!recordsAreEqual(beforeRecord, currentRecord)) {
+      const { ".id": _, ...data } = beforeRecord;
+      toUpdate.push({ currentId: currentRecord[".id"], data });
+    }
+  }
+  const toRemove = current.filter((r) => !beforeByKey.has(semanticKey(r, keys))).map((r) => r[".id"]);
+  return applyUserRestriction(path, { path, toCreate, toRemove, toUpdate, warnings });
+}
+async function applyRestorePlan(plan, client) {
+  for (const id of plan.toRemove) {
+    await client.remove(plan.path, id);
+  }
+  for (const record of plan.toCreate) {
+    const { ".id": _, ...data } = record;
+    await client.create(plan.path, data);
+  }
+  for (const { currentId, data } of plan.toUpdate) {
+    await client.update(plan.path, currentId, data);
+  }
+}
+
+// src/domain/snapshot/snapshot-engine.ts
+function pathToSlug(rosPath) {
+  return rosPath.replace(/\//g, "-");
+}
+function timestampPrefix() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 15);
+}
+async function persist(stored, snapshotDir) {
+  const dir = join2(snapshotDir, stored.routerId);
+  const filePath = join2(dir, `${stored.id}.json`);
+  await mkdir(dir, { recursive: true });
+  await writeFile(filePath, JSON.stringify(stored, null, 2));
+  return {
+    id: stored.id,
+    routerId: stored.routerId,
+    path: stored.path,
+    ts: stored.ts,
+    filePath,
+    recordCount: stored.records.length
+  };
+}
+async function takeSnapshot(client, routerId2, path, snapshotDir) {
+  const id = `${timestampPrefix()}-${pathToSlug(path)}-${nanoid(6)}`;
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  if (client instanceof SwosClient) {
+    const blob = await client.getRaw(path);
+    return persist({ id, routerId: routerId2, path, ts, records: [], blob }, snapshotDir);
+  }
+  const records = normalizeForDiff(await client.get(path, {}));
+  return persist({ id, routerId: routerId2, path, ts, records }, snapshotDir);
+}
+async function loadSnapshot(filePath) {
+  return JSON.parse(await readFile(filePath, "utf-8"));
+}
+
+// src/domain/snapshot/write-journal.ts
+import { appendFile as appendFile2, mkdir as mkdir2 } from "fs/promises";
+import { dirname } from "path";
+import { nanoid as nanoid2 } from "nanoid";
+
+// src/observability/audit-log.ts
+import { appendFile } from "fs/promises";
+var log22 = createLogger("audit");
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "password",
+  "pass",
+  "token",
+  "secret",
+  "authorization",
+  "credentials",
+  "privatekey",
+  "presharedkey",
+  "psk",
+  "passphrase",
+  "community",
+  "apikey",
+  "confirmationsecret"
+]);
+function redactValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(redactValue);
+  }
+  if (value !== null && typeof value === "object") {
+    return redactParams(value);
+  }
+  return value;
 }
 function redactParams(params) {
   const out = {};
@@ -5687,6 +6823,36 @@ var rollbackChangeInputSchema = z24.object({
   journalId: z24.string().describe("Journal entry ID from write-journal.ndjson to roll back"),
   dryRun: z24.boolean().default(false).describe("Preview the restore plan without applying changes")
 }).strict();
+async function restoreSwosBlobs(snapshots, journalId, dryRun2, context) {
+  const client = context.swosClient;
+  if (!client) {
+    throw new MikroMCPError({
+      category: "VALIDATION" /* VALIDATION */,
+      code: "PLATFORM_MISMATCH",
+      message: `Journal entry "${journalId}" holds SwOS blob snapshots, but router "${context.routerId}" is not a SwOS switch.`,
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Roll back against the switch the write was made on."
+      }
+    });
+  }
+  const targets = snapshots.map((s) => ({ endpoint: s.path, blob: s.blob }));
+  if (dryRun2) {
+    return {
+      content: `Rollback dry run for journal entry "${journalId}": would restore ${targets.length} SwOS endpoint(s).
+` + targets.map((t) => `  ${t.endpoint}:
+${t.blob}`).join("\n"),
+      structuredContent: { action: "dry_run", journalId, targets }
+    };
+  }
+  for (const target of targets) {
+    await client.postRaw(target.endpoint, target.blob);
+  }
+  return {
+    content: `Rolled back journal entry "${journalId}": restored ${targets.map((t) => t.endpoint).join(", ")}.`,
+    structuredContent: { action: "rolled_back", journalId, targets }
+  };
+}
 function createChangeManagementTools(baseTools2) {
   const toolMap = new Map(baseTools2.map((t) => [t.name, t]));
   function requireTool(name) {
@@ -5722,7 +6888,7 @@ function createChangeManagementTools(baseTools2) {
       for (const [i, step] of parsed.steps.entries()) {
         const tool = requireTool(step.tool);
         const currentState = {};
-        for (const path of tool.snapshotPaths ?? []) {
+        for (const path of snapshotPathsFor(tool, { ...step.params, routerId: parsed.routerId })) {
           try {
             currentState[path] = await context.routerClient.get(path, {});
           } catch {
@@ -5779,14 +6945,12 @@ function createChangeManagementTools(baseTools2) {
         const tool = requireTool(step.tool);
         const stepParams = { ...step.params, routerId: parsed.routerId };
         const snapshotIds = [];
-        if (tool.snapshotPaths && tool.snapshotPaths.length > 0) {
-          for (const path of tool.snapshotPaths) {
-            try {
-              const meta = await takeSnapshot(context.routerClient, context.routerId, path, snapshotDir);
-              snapshotIds.push(meta.id);
-            } catch (err) {
-              log24.warn({ err, path, routerId: context.routerId, step: i }, "apply_plan step snapshot failed \u2014 proceeding without snapshot");
-            }
+        for (const path of snapshotPathsFor(tool, stepParams)) {
+          try {
+            const meta = await takeSnapshot(context.deviceClient, context.routerId, path, snapshotDir);
+            snapshotIds.push(meta.id);
+          } catch (err) {
+            log24.warn({ err, path, routerId: context.routerId, step: i }, "apply_plan step snapshot failed \u2014 proceeding without snapshot");
           }
         }
         const stepJournalId = recordAttempt({
@@ -5838,7 +7002,7 @@ function createChangeManagementTools(baseTools2) {
     }
   };
   function findJournalEntry(journalPath, journalId) {
-    const raw = readFileSync(journalPath, "utf-8");
+    const raw = readFileSync2(journalPath, "utf-8");
     const lines = raw.split("\n").filter(Boolean);
     const entry = lines.map((l) => JSON.parse(l)).find((e) => e.id === journalId && e.phase === "attempt");
     if (!entry) {
@@ -5857,7 +7021,7 @@ function createChangeManagementTools(baseTools2) {
   const rollbackChangeTool = {
     name: "rollback_change",
     title: "Rollback Change",
-    description: "Restore RouterOS state to before a write, identified by its journal ID: reads the before-snapshot, diffs against live state, and applies the reverse. Use dryRun=true to preview the restore plan. Requires MIKROMCP_DATA_DIR (defaults to data/).",
+    description: "Restore device state to before a write, identified by its journal ID. RouterOS: reads the before-snapshot, diffs against live state, and applies the reverse. SwOS: re-POSTs the exact pre-write '.b' blob. Use dryRun=true to preview. Requires MIKROMCP_DATA_DIR (defaults to data/).",
     inputSchema: rollbackChangeInputSchema,
     annotations: {
       readOnlyHint: false,
@@ -5865,6 +7029,7 @@ function createChangeManagementTools(baseTools2) {
       idempotentHint: false,
       openWorldHint: false
     },
+    platform: "any",
     async handler(params, context) {
       const parsed = rollbackChangeInputSchema.parse(params);
       const journalPath = context.appConfig.journalPath;
@@ -5877,10 +7042,17 @@ function createChangeManagementTools(baseTools2) {
           structuredContent: { action: "no_snapshot", journalId: parsed.journalId }
         };
       }
+      const snapshots = await Promise.all(
+        snapshotIds.map(
+          (snapshotId) => loadSnapshot(`${snapshotDir}/${context.routerId}/${snapshotId}.json`)
+        )
+      );
+      const swosSnapshots = snapshots.filter((s) => s.blob !== void 0);
+      if (swosSnapshots.length > 0) {
+        return restoreSwosBlobs(swosSnapshots, parsed.journalId, parsed.dryRun, context);
+      }
       const restorePlans = [];
-      for (const snapshotId of snapshotIds) {
-        const filePath = `${snapshotDir}/${context.routerId}/${snapshotId}.json`;
-        const stored = await loadSnapshot(filePath);
+      for (const stored of snapshots) {
         const current = await context.routerClient.get(stored.path, {});
         const plan = computeRestorePlan(stored.path, stored.records, current);
         restorePlans.push(plan);
@@ -11019,27 +12191,437 @@ var manageInterfaceListMemberTool = {
       await context.routerClient.remove("interface/list/member", existing[".id"]);
       log45.info({ list: parsed.list, interface: parsed.interface }, "Interface list member removed");
       return {
-        content: `Removed "${parsed.interface}" from list "${parsed.list}".`,
+        content: `Removed "${parsed.interface}" from list "${parsed.list}".`,
+        structuredContent: {
+          action: "removed",
+          list: parsed.list,
+          interface: parsed.interface,
+          id: existing[".id"]
+        }
+      };
+    } catch (err) {
+      throw toolError(err, context, "manage_interface_list_member");
+    }
+  }
+};
+var interfaceListTools = [
+  listInterfaceListsTool,
+  manageInterfaceListTool,
+  manageInterfaceListMemberTool
+];
+
+// src/domain/tools/swos-tools.ts
+import { z as z46 } from "zod";
+var log46 = createLogger("swos-tools");
+var endpointEnum = z46.enum(SWOS_ENDPOINTS);
+var MAX_CONTENT_CHARS = 8e3;
+function requireSwosClient(context) {
+  if (!context.swosClient) {
+    throw new MikroMCPError({
+      category: "VALIDATION" /* VALIDATION */,
+      code: "PLATFORM_MISMATCH",
+      message: `Router "${context.routerId}" is not configured as a SwOS switch (deviceType: "swos").`,
+      recoverability: {
+        retryable: false,
+        suggestedAction: 'Set deviceType: "swos" for this device in routers.yaml, or target a switch.'
+      }
+    });
+  }
+  return context.swosClient;
+}
+async function readFirmwareSupport(client) {
+  try {
+    const sys = await client.get("sys.b");
+    return firmwareSupport(sys.model, sys.version);
+  } catch (err) {
+    log46.warn({ err }, "Could not read sys.b for the firmware compatibility check");
+    return {
+      verified: false,
+      note: `Firmware could not be read (${err instanceof Error ? err.message : String(err)}); compatibility unknown.`
+    };
+  }
+}
+var listEndpointsSchema = z46.object({
+  routerId
+}).strict();
+var listSwosEndpointsTool = {
+  name: "list_swos_endpoints",
+  title: "List SwOS Endpoints",
+  description: "List the SwOS/SwOS Lite '.b' API endpoints supported by this server, with the decoded field names per endpoint. Read-only schema introspection \u2014 no device call.",
+  inputSchema: listEndpointsSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  platform: "swos",
+  async handler(params, context) {
+    listEndpointsSchema.parse(params);
+    const endpoints = SWOS_ENDPOINTS.map((ep) => ({
+      endpoint: ep,
+      fields: SWOS_SCHEMA[ep].fields.map((f2) => f2.name)
+    }));
+    const content = endpoints.map(
+      (e) => `${e.endpoint}
+  fields: ${e.fields.length > 0 ? e.fields.join(", ") : "(decoded generically per port)"}`
+    ).join("\n");
+    return {
+      content: `SwOS endpoints:
+${content}`,
+      structuredContent: { routerId: context.routerId, endpoints }
+    };
+  }
+};
+var STATUS_ENDPOINTS = ["link.b", "sys.b", "poe.b", "sfp.b"];
+var getStatusSchema = z46.object({
+  routerId,
+  include: z46.array(z46.enum(STATUS_ENDPOINTS)).default([...STATUS_ENDPOINTS]).describe("Which status endpoints to fetch")
+}).strict();
+function sectionOf(sections, endpoint) {
+  const section = sections[endpoint];
+  return section && !("_error" in section) ? section : void 0;
+}
+function formatStatus(sections) {
+  const lines = [];
+  const sys = sectionOf(sections, "sys.b");
+  if (sys) {
+    const firmware = firmwareSupport(sys.model, sys.version);
+    lines.push("Switch:");
+    if (sys.identity) lines.push(`  Identity: ${sys.identity}`);
+    if (sys.model) lines.push(`  Model: ${sys.model}`);
+    if (sys.version) {
+      lines.push(
+        `  Firmware: ${sys.version}${firmware.verified ? " (schema verified)" : " (schema not verified for this firmware \u2014 see the note on writes)"}`
+      );
+    }
+    if (sys.serial) lines.push(`  Serial: ${sys.serial}`);
+    if (sys.uptime) lines.push(`  Uptime: ${String(sys.uptime)}s`);
+    if (sys.ip) lines.push(`  IP: ${sys.ip}`);
+    if (sys.mac) lines.push(`  MAC: ${sys.mac}`);
+  }
+  const link = sectionOf(sections, "link.b");
+  if (link) {
+    const names = link.name;
+    const speeds = link.speed;
+    const links = link.link;
+    const dups = link.duplex;
+    const count = Math.max(names?.length ?? 0, speeds?.length ?? 0, links?.length ?? 0);
+    lines.push("Ports:");
+    for (let i = 0; i < count; i++) {
+      const name = names?.[i] ?? `port${i + 1}`;
+      const speed = speeds?.[i] ?? "?";
+      const linkState = links?.[i] ? "up" : "down";
+      const dup = dups?.[i] === void 0 ? "?" : dups[i] ? "full" : "half";
+      lines.push(`  ${String(name)}: ${linkState} (${String(speed)} ${dup})`);
+    }
+  }
+  const poe = sectionOf(sections, "poe.b");
+  if (poe) {
+    const out = poe.out;
+    const state = poe.state;
+    const power = poe.power;
+    const count = Math.max(out?.length ?? 0, state?.length ?? 0);
+    lines.push("PoE:");
+    for (let i = 0; i < count; i++) {
+      const mode = out?.[i] ?? "?";
+      const st = state?.[i] ?? "?";
+      const pw = power?.[i] !== void 0 ? `${String(power[i])}W` : "";
+      lines.push(`  port${i + 1}: ${String(mode)} / ${String(st)} ${pw}`.trimEnd());
+    }
+  }
+  const sfp = sectionOf(sections, "sfp.b");
+  if (sfp) {
+    const cages = Math.max(
+      ...["vendor", "part_number", "serial", "temperature"].map(
+        (key2) => sfp[key2]?.length ?? 0
+      )
+    );
+    if (cages > 0) {
+      lines.push("SFP modules:");
+      for (let i = 0; i < cages; i++) {
+        const vendor = sfp.vendor?.[i];
+        const part = sfp.part_number?.[i];
+        if (!vendor && !part) continue;
+        const serial = sfp.serial?.[i];
+        const temp = sfp.temperature?.[i];
+        lines.push(
+          `  sfp${i + 1}: ${String(vendor ?? "?")} ${String(part ?? "?")}${serial ? ` sn=${String(serial)}` : ""}${temp !== void 0 ? ` ${String(temp)}\xB0C` : ""}`
+        );
+      }
+    }
+  }
+  const failed = Object.entries(sections).filter(([, v]) => v && typeof v === "object" && "_error" in v).map(([ep, v]) => `  ${ep}: ${v._error}`);
+  if (failed.length > 0) lines.push("Sections that failed to load:", ...failed);
+  return lines.length > 0 ? lines.join("\n") : "No status retrieved.";
+}
+var getSwosStatusTool = {
+  name: "get_swos_status",
+  title: "Get SwOS Status",
+  description: "Retrieve status from a MikroTik SwOS switch (SwOS or SwOS Lite): identity, model, firmware, uptime, per-port link state/speed/duplex, PoE mode/state/power, and SFP modules.",
+  inputSchema: getStatusSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  platform: "swos",
+  async handler(params, context) {
+    const parsed = getStatusSchema.parse(params);
+    const client = requireSwosClient(context);
+    const sections = {};
+    for (const ep of parsed.include) {
+      try {
+        sections[ep] = await client.get(ep);
+      } catch (err) {
+        log46.warn({ ep, err }, "SwOS status section failed, skipping");
+        sections[ep] = { _error: err instanceof Error ? err.message : String(err) };
+      }
+    }
+    const sys = sectionOf(sections, "sys.b");
+    return {
+      content: formatStatus(sections),
+      structuredContent: {
+        routerId: context.routerId,
+        sections,
+        ...sys ? { compatibility: firmwareSupport(sys.model, sys.version) } : {}
+      }
+    };
+  }
+};
+var getEndpointSchema = z46.object({
+  routerId,
+  endpoint: endpointEnum.describe("'.b' endpoint to fetch (see list_swos_endpoints)")
+}).strict();
+var getSwosEndpointTool = {
+  name: "get_swos_endpoint",
+  title: "Get SwOS Endpoint",
+  description: "Fetch and decode a single SwOS '.b' endpoint (link.b, sys.b, poe.b, lacp.b, rstp.b, snmp.b, fwd.b, vlan.b, stats.b, sfp.b, host.b, acl.b, ...) as structured data. Unknown keys are preserved under '_raw'.",
+  inputSchema: getEndpointSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  platform: "swos",
+  async handler(params, context) {
+    const parsed = getEndpointSchema.parse(params);
+    const client = requireSwosClient(context);
+    try {
+      const decoded = await client.get(parsed.endpoint);
+      const rendered = JSON.stringify(decoded, null, 2);
+      const content = rendered.length > MAX_CONTENT_CHARS ? `${rendered.slice(0, MAX_CONTENT_CHARS)}
+\u2026 truncated (${rendered.length} chars). Full decode is in structuredContent.` : rendered;
+      return {
+        content,
+        structuredContent: { routerId: context.routerId, endpoint: parsed.endpoint, data: decoded }
+      };
+    } catch (err) {
+      throw toolError(err, context, "get_swos_endpoint");
+    }
+  }
+};
+var WRITABLE_ENDPOINTS = SWOS_ENDPOINTS.filter(
+  (ep) => !ep.startsWith("!") && !SWOS_SCHEMA[ep].isArray
+);
+var writeBlobSchema = z46.object({
+  routerId,
+  endpoint: z46.enum(WRITABLE_ENDPOINTS).describe("'.b' endpoint to write"),
+  fields: z46.record(
+    z46.string(),
+    z46.union([
+      z46.string(),
+      z46.number(),
+      z46.boolean(),
+      z46.array(z46.union([z46.string(), z46.number(), z46.boolean()]))
+    ])
+  ).describe(
+    "Values to set, keyed by decoded field name (from list_swos_endpoints) or by a raw wire key already present in the blob \u2014 anything else is rejected. Option fields take the enum name (e.g. 'auto'); text becomes a UTF-8 hex string; numbers and '0x...' strings are written as hex, padded to the width of the value they replace. A per-port field given a single value applies it to EVERY port."
+  ),
+  dryRun: z46.boolean().default(true).describe("Preview the resulting blob without writing to the switch.")
+}).strict();
+function resolveField(epKey, key2) {
+  const ep = SWOS_SCHEMA[epKey];
+  if (!ep) return void 0;
+  return ep.fields.find((field) => field.name === key2 || Object.values(field.keys).includes(key2));
+}
+function resolveWireKey(field, wire) {
+  return Object.values(field.keys).find((key2) => key2 in wire);
+}
+function validationError(code, message, suggestedAction) {
+  return new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code,
+    message,
+    recoverability: { retryable: false, suggestedAction }
+  });
+}
+function coerceValue(field, value, existing) {
+  if (Array.isArray(value)) {
+    const existingItems = Array.isArray(existing) ? existing : [];
+    return value.map((v, i) => coerceScalar(field, v, existingItems[i]));
+  }
+  return coerceScalar(field, value, existing);
+}
+function coerceScalar(field, value, existing) {
+  if (typeof value === "boolean") {
+    if (field.kind === Kind.BOOL) {
+      throw validationError(
+        "SWOS_FIELD_SHAPE_MISMATCH",
+        `Field "${field.name}" is a per-port bitmask, not a single flag.`,
+        "Pass the mask as a number \u2014 e.g. 1023 for all 10 ports, 0 for none."
+      );
+    }
+    return encodeLike(value ? 1 : 0, existing);
+  }
+  if (typeof value === "number") return encodeLike(value, existing);
+  if (field.kind === Kind.OPTION) {
+    const idx = (field.options ?? []).indexOf(String(value));
+    if (idx < 0) {
+      throw validationError(
+        "SWOS_INVALID_OPTION",
+        `Invalid option "${String(value)}" for field "${field.name}".`,
+        `Use one of: ${(field.options ?? []).join(", ")}.`
+      );
+    }
+    return encodeLike(idx, existing);
+  }
+  const text = String(value);
+  return isWireHex(text) ? text : Buffer.from(text, "utf8").toString("hex");
+}
+function assertShapeMatches(perPort, key2, next, existing) {
+  if (existing === void 0) return;
+  if (Array.isArray(next) && Array.isArray(existing)) {
+    if (next.length === existing.length) return;
+    throw validationError(
+      "SWOS_FIELD_SHAPE_MISMATCH",
+      `Field "${key2}" holds ${existing.length} value(s) on the wire, but ${next.length} were given.`,
+      `Pass exactly ${existing.length} value(s), or a single value to apply to all of them.`
+    );
+  }
+  if (!Array.isArray(next) && !Array.isArray(existing)) return;
+  if (!Array.isArray(next) && perPort) return;
+  throw validationError(
+    "SWOS_FIELD_SHAPE_MISMATCH",
+    Array.isArray(next) ? `Field "${key2}" is a single per-port bitmask on the wire, but an array was given.` : `Field "${key2}" is a per-port array on the wire, but a single value was given.`,
+    Array.isArray(next) ? "Pass the bitmask as one number (e.g. 1023 for all 10 ports)." : "Pass one value per port."
+  );
+}
+var writeSwosBlobTool = {
+  name: "write_swos_blob",
+  title: "Write SwOS Blob",
+  description: "Mutate a SwOS '.b' endpoint on a MikroTik switch. The full endpoint blob is read, the given fields are merged in, and the entire blob is written back (the firmware only accepts whole-blob writes); untouched fields are re-sent byte-for-byte, and a field this firmware does not expose is refused rather than injected. dryRun defaults to true \u2014 preview first. Every result reports whether the schema has been verified against the switch's firmware. The pre-write blob is snapshotted, so the change can be undone with rollback_change. Returns no_change when the values already match.",
+  inputSchema: writeBlobSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  platform: "swos",
+  // The endpoint is an argument, so the snapshot path is too. The executor
+  // captures the pre-write blob verbatim; rollback_change re-POSTs it.
+  snapshotPaths: (params) => params.endpoint ? [String(params.endpoint)] : [],
+  async handler(params, context) {
+    const parsed = writeBlobSchema.parse(params);
+    const client = requireSwosClient(context);
+    try {
+      const wire = await client.readBlobForWrite(parsed.endpoint);
+      const changes = {};
+      for (const [key2, value] of Object.entries(parsed.fields)) {
+        const field = resolveField(parsed.endpoint, key2);
+        const targetKey = field ? resolveWireKey(field, wire) : key2;
+        if (targetKey === void 0 || !(targetKey in wire)) {
+          throw validationError(
+            "SWOS_UNKNOWN_FIELD",
+            field ? `Field "${key2}" is not present in ${parsed.endpoint} on this device \u2014 its firmware does not expose it.` : `Unknown field "${key2}" for endpoint ${parsed.endpoint}.`,
+            `Read the endpoint first; only keys the device actually sent can be written: ${Object.keys(wire).join(", ")}.`
+          );
+        }
+        const existing = wire[targetKey];
+        const next = field ? coerceValue(field, value, existing) : value;
+        assertShapeMatches(field?.perPort ?? false, key2, next, existing);
+        if (field?.perPort && !Array.isArray(next) && Array.isArray(existing)) {
+          wire[targetKey] = existing.map(() => next);
+        } else {
+          wire[targetKey] = next;
+        }
+        changes[key2] = { from: existing, to: wire[targetKey] };
+      }
+      const modified = Object.entries(changes).filter(
+        ([, c]) => JSON.stringify(c.from) !== JSON.stringify(c.to)
+      );
+      if (modified.length === 0) {
+        return {
+          content: `No change: ${parsed.endpoint} on ${context.routerId} already has these values.`,
+          structuredContent: {
+            routerId: context.routerId,
+            endpoint: parsed.endpoint,
+            action: "no_change",
+            changes
+          }
+        };
+      }
+      const diff = modified.map(([key2, c]) => `  ${key2}: ${JSON.stringify(c.from)} -> ${JSON.stringify(c.to)}`).join("\n");
+      const preview = dumpBlob(wire);
+      const firmware = await readFirmwareSupport(client);
+      const unmapped = unmappedWireKeys(parsed.endpoint, wire);
+      const banner = `${firmware.verified ? "Firmware" : "\u26A0\uFE0F  Firmware"}: ${firmware.note}` + (unmapped.length > 0 ? `
+\u26A0\uFE0F  ${unmapped.length} key(s) in ${parsed.endpoint} are not in the schema and are re-sent unchanged: ${unmapped.join(", ")}` : "");
+      const compatibility = { ...firmware, unmappedKeys: unmapped };
+      if (parsed.dryRun) {
+        return {
+          content: `DRY RUN \u2014 no write performed. ${modified.length} field(s) would change on ${parsed.endpoint}:
+${diff}
+
+${banner}
+
+Resulting blob:
+${preview}`,
+          structuredContent: {
+            routerId: context.routerId,
+            endpoint: parsed.endpoint,
+            action: "dry_run",
+            dryRun: true,
+            changes,
+            compatibility,
+            blob: preview
+          }
+        };
+      }
+      const response = await client.writeBlob(parsed.endpoint, wire);
+      return {
+        content: `Wrote ${parsed.endpoint} on ${context.routerId}:
+${diff}
+${banner}
+Response: ${response || "(empty)"}
+The pre-write blob was snapshotted \u2014 undo with rollback_change using this call's journal ID.`,
         structuredContent: {
-          action: "removed",
-          list: parsed.list,
-          interface: parsed.interface,
-          id: existing[".id"]
+          routerId: context.routerId,
+          endpoint: parsed.endpoint,
+          action: "written",
+          dryRun: false,
+          changes,
+          compatibility,
+          response
         }
       };
     } catch (err) {
-      throw toolError(err, context, "manage_interface_list_member");
+      throw toolError(err, context, "write_swos_blob");
     }
   }
 };
-var interfaceListTools = [
-  listInterfaceListsTool,
-  manageInterfaceListTool,
-  manageInterfaceListMemberTool
+var swosTools = [
+  listSwosEndpointsTool,
+  getSwosStatusTool,
+  getSwosEndpointTool,
+  writeSwosBlobTool
 ];
 
 // src/domain/tools/fleet-tools.ts
-import { z as z46 } from "zod";
+import { z as z47 } from "zod";
 
 // src/middleware/authz.ts
 function matchesPattern(name, pattern) {
@@ -11121,7 +12703,7 @@ function getCredentials(router) {
 }
 
 // src/adapter/ssh-client.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { Client } from "ssh2";
 var SshClient = class {
   constructor(config, credentials, options) {
@@ -11209,7 +12791,7 @@ var SshClient = class {
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
-          const actual = createHash("sha256").update(key2).digest("hex");
+          const actual = createHash2("sha256").update(key2).digest("hex");
           return actual === expected;
         };
       }
@@ -11221,7 +12803,7 @@ var SshClient = class {
 // src/adapter/ftp-client.ts
 import { Client as Client2 } from "basic-ftp";
 import { Readable } from "stream";
-var log46 = createLogger("ftp-client");
+var log47 = createLogger("ftp-client");
 var FtpClient = class {
   #host;
   #port;
@@ -11234,7 +12816,7 @@ var FtpClient = class {
     this.#password = password;
   }
   async upload(remoteName, content) {
-    log46.info({ host: this.#host, remoteName }, "Uploading file via FTP");
+    log47.info({ host: this.#host, remoteName }, "Uploading file via FTP");
     const client = new Client2();
     try {
       await client.access({
@@ -11244,7 +12826,7 @@ var FtpClient = class {
         password: this.#password
       });
       await client.uploadFrom(Readable.from(Buffer.from(content, "utf-8")), remoteName);
-      log46.info({ host: this.#host, remoteName }, "FTP upload complete");
+      log47.info({ host: this.#host, remoteName }, "FTP upload complete");
     } finally {
       client.close();
     }
@@ -11266,7 +12848,7 @@ var FtpClient = class {
 };
 
 // src/adapter/sftp-client.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { Client as Client3 } from "ssh2";
 var SftpClient = class {
   constructor(config, credentials) {
@@ -11308,7 +12890,7 @@ var SftpClient = class {
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
-          const actual = createHash2("sha256").update(key2).digest("hex");
+          const actual = createHash3("sha256").update(key2).digest("hex");
           return actual === expected;
         };
       }
@@ -11335,8 +12917,21 @@ function createSftpClient(routerConfig) {
 function buildRouterToolContext(args) {
   const { routerConfig, correlationId, identity, pool, config, registry } = args;
   const credentials = getCredentials(routerConfig);
+  const deviceClient = pool.getClient(routerConfig, credentials);
+  const swosClient = deviceClient instanceof SwosClient ? deviceClient : void 0;
+  const restClient = swosClient ? void 0 : deviceClient;
   return {
-    routerClient: pool.getClient(routerConfig, credentials),
+    // Platform gating (tool-executor / bulk_execute) guarantees a RouterOS tool
+    // never reaches a SwOS device, so `routerClient` is only ever dereferenced
+    // when the pool actually returned a REST client. `deviceClient` carries the
+    // honest type for platform-aware callers.
+    routerClient: restClient ?? unavailableCapability(
+      "ROUTEROS_CLIENT_UNAVAILABLE",
+      `Router "${routerConfig.id}" is a SwOS switch and has no RouterOS REST API.`,
+      "Use a swos_* tool, or target a RouterOS router."
+    ),
+    deviceClient,
+    swosClient,
     routerId: routerConfig.id,
     correlationId,
     routerConfig,
@@ -11435,13 +13030,13 @@ function getStdioIdentity(stdioIdentityName, registry) {
 }
 
 // src/middleware/confirmation.ts
-import { createHmac, createHash as createHash3, timingSafeEqual } from "crypto";
+import { createHmac, createHash as createHash4, timingSafeEqual } from "crypto";
 var CONFIRMATION_TTL_MS = 5 * 60 * 1e3;
 var BYPASS_ROLES = ["admin", "superadmin"];
 var usedTokens = /* @__PURE__ */ new Map();
 function computeParamHash(params) {
   const { confirmationToken: _, ...rest } = params;
-  return createHash3("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash4("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function sign(tool, routerId2, identityId, paramHash, expiresAtMs, secret) {
   const payload = `${tool}|${routerId2}|${identityId}|${paramHash}|${expiresAtMs}`;
@@ -11756,7 +13351,7 @@ var CircuitBreaker = class {
 };
 
 // src/mcp/tool-executor.ts
-var log47 = createLogger("tool-executor");
+var log48 = createLogger("tool-executor");
 var AMBIGUOUS_WRITE_CATEGORIES = /* @__PURE__ */ new Set([
   "ROUTER_TIMEOUT" /* ROUTER_TIMEOUT */,
   "ROUTER_UNREACHABLE" /* ROUTER_UNREACHABLE */
@@ -11810,17 +13405,24 @@ function assertMaintenanceWindow(isDestructive, routerConfig, routerId2) {
   }
 }
 function fleetUnavailable(what) {
-  return new Proxy({}, {
-    get() {
-      throw new MikroMCPError({
-        category: "INTERNAL" /* INTERNAL */,
-        code: "FLEET_CONTEXT_UNAVAILABLE",
-        message: `${what} is not available in a fleet-tool context (skipRouterContext). Target a specific router instead.`,
-        recoverability: {
-          retryable: false,
-          suggestedAction: "Use a router-scoped tool, or pass a routerId to operate on one router."
-        }
-      });
+  return unavailableCapability(
+    "FLEET_CONTEXT_UNAVAILABLE",
+    `${what} is not available in a fleet-tool context (skipRouterContext). Target a specific router instead.`,
+    "Use a router-scoped tool, or pass a routerId to operate on one router."
+  );
+}
+function assertPlatformMatch(tool, routerConfig) {
+  const toolPlatform = tool.platform ?? "routeros";
+  const devicePlatform = routerConfig.deviceType ?? "routeros";
+  if (toolPlatform === "any" || toolPlatform === devicePlatform) return;
+  throw new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code: "PLATFORM_MISMATCH",
+    message: `Tool "${tool.name}" runs on ${toolPlatform} devices, but router "${routerConfig.id}" is a ${devicePlatform} device.`,
+    details: { toolPlatform, devicePlatform },
+    recoverability: {
+      retryable: false,
+      suggestedAction: toolPlatform === "swos" ? "Target a SwOS switch instead \u2014 check list_routers for the deviceType of each device." : "Target a RouterOS device instead \u2014 check list_routers for the deviceType of each device."
     }
   });
 }
@@ -11835,6 +13437,7 @@ async function executeToolCall(tool, args, deps) {
       if (tool.skipRouterContext) {
         const fleetContext = {
           routerClient: fleetUnavailable("routerClient"),
+          deviceClient: fleetUnavailable("deviceClient"),
           routerId: "",
           correlationId,
           routerConfig: fleetUnavailable("routerConfig"),
@@ -11855,6 +13458,7 @@ async function executeToolCall(tool, args, deps) {
       args.routerId = routerId2;
       checkAuthz(identity, tool.name, routerId2);
       const routerConfig = registry.getRouter(routerId2);
+      assertPlatformMatch(tool, routerConfig);
       assertMaintenanceWindow(tool.annotations.destructiveHint, routerConfig, routerId2);
       if (tool.annotations.destructiveHint && config.confirmationSecret) {
         await checkConfirmation(tool.name, routerId2, args, identity, config.confirmationSecret);
@@ -11885,14 +13489,14 @@ async function executeToolCall(tool, args, deps) {
       toolContext.circuitBreaker = cb;
       const { confirmationToken: _ct, ...handlerArgs } = args;
       const snapshotIds = [];
-      if (tool.snapshotPaths && tool.snapshotPaths.length > 0 && !tool.annotations.readOnlyHint) {
-        for (const path of tool.snapshotPaths) {
+      if (!tool.annotations.readOnlyHint) {
+        for (const path of snapshotPathsFor(tool, handlerArgs)) {
           try {
-            const meta = await takeSnapshot(toolContext.routerClient, routerId2, path, config.snapshotDir);
+            const meta = await takeSnapshot(toolContext.deviceClient, routerId2, path, config.snapshotDir);
             snapshotIds.push(meta.id);
-            log47.debug({ snapshotId: meta.id, path }, "Snapshot taken");
+            log48.debug({ snapshotId: meta.id, path }, "Snapshot taken");
           } catch (err) {
-            log47.warn({ err, path, routerId: routerId2 }, "Snapshot failed \u2014 proceeding without snapshot");
+            log48.warn({ err, path, routerId: routerId2 }, "Snapshot failed \u2014 proceeding without snapshot");
           }
         }
       }
@@ -11933,7 +13537,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log47.info({ tool: tool.name, routerId: routerId2, correlationId }, "Tool executed successfully");
+      log48.info({ tool: tool.name, routerId: routerId2, correlationId }, "Tool executed successfully");
       recordToolCall(tool.name, "success");
       return formatToolResult(result);
     } catch (err) {
@@ -11945,7 +13549,7 @@ async function executeToolCall(tool, args, deps) {
         const failedRouterId = args.routerId;
         if (failedRouterId) {
           pool.removeClient(failedRouterId);
-          log47.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
+          log48.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
         }
       }
       if (journalId) {
@@ -11975,7 +13579,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log47.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
+      log48.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
       recordToolCall(tool.name, "error");
       return formatError(error);
     }
@@ -11983,7 +13587,7 @@ async function executeToolCall(tool, args, deps) {
 }
 
 // src/middleware/fleet-confirmation.ts
-import { createHmac as createHmac2, createHash as createHash4, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac2, createHash as createHash5, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var CONFIRMATION_TTL_MS2 = 5 * 60 * 1e3;
 var usedTokens2 = /* @__PURE__ */ new Map();
 function fingerprint(args) {
@@ -11994,7 +13598,7 @@ function fingerprint(args) {
     params: args.params,
     identityId: args.identityId
   });
-  return createHash4("sha256").update(payload).digest("hex");
+  return createHash5("sha256").update(payload).digest("hex");
 }
 function sign2(fp, expiresAtMs, secret) {
   const mac = createHmac2("sha256", secret).update(`${fp}|${expiresAtMs}`).digest("hex");
@@ -12053,22 +13657,29 @@ function checkFleetConfirmation(args, secret) {
 }
 
 // src/domain/tools/fleet-tools.ts
-var log48 = createLogger("fleet-tools");
-var checkHealthInputSchema = z46.object({
+var log49 = createLogger("fleet-tools");
+function swosResourceRecord(sys) {
+  const decoded = sys ?? {};
+  return {
+    version: String(decoded.version ?? ""),
+    uptime: `${String(decoded.uptime ?? 0)}s`
+  };
+}
+var checkHealthInputSchema = z47.object({
   routerId
 }).strict();
-var bulkExecuteInputSchema = z46.object({
-  toolName: z46.string().describe("Name of the tool to fan out (must be a single-router tool)"),
-  routerIds: z46.array(z46.string()).optional().describe("Explicit list of router IDs to target"),
-  tags: z46.array(z46.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
-  params: z46.record(z46.string(), z46.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
-  concurrency: z46.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
-  confirmationToken: z46.string().optional().describe(
+var bulkExecuteInputSchema = z47.object({
+  toolName: z47.string().describe("Name of the tool to fan out (must be a single-router tool)"),
+  routerIds: z47.array(z47.string()).optional().describe("Explicit list of router IDs to target"),
+  tags: z47.array(z47.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
+  params: z47.record(z47.string(), z47.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
+  concurrency: z47.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
+  confirmationToken: z47.string().optional().describe(
     "Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool."
   )
 }).strict();
-var listRoutersInputSchema = z46.object({
-  tags: z46.array(z46.string()).optional().describe('Only return routers having any of these tags (e.g. ["edge", "prod"])')
+var listRoutersInputSchema = z47.object({
+  tags: z47.array(z47.string()).optional().describe('Only return routers having any of these tags (e.g. ["edge", "prod"])')
 }).strict();
 var listRoutersTool = {
   name: "list_routers",
@@ -12086,7 +13697,7 @@ var listRoutersTool = {
     const parsed = listRoutersInputSchema.parse(params);
     const { identity, appConfig } = context;
     const defaultRouter = appConfig.defaultRouter;
-    log48.info({ tags: parsed.tags, identityId: identity.id }, "Listing routers");
+    log49.info({ tags: parsed.tags, identityId: identity.id }, "Listing routers");
     let routers = context.routerRegistry.listRouters(parsed.tags);
     if (identity.allowedRouters.length > 0) {
       routers = routers.filter((r) => identity.allowedRouters.includes(r.id));
@@ -12096,6 +13707,7 @@ var listRoutersTool = {
       id: r.id,
       host: r.host,
       port: r.port,
+      deviceType: r.deviceType ?? "routeros",
       tlsEnabled: r.tls.enabled,
       tags: r.tags,
       rosVersion: r.rosVersion,
@@ -12106,7 +13718,7 @@ var listRoutersTool = {
     const lines = rows.map(
       (r) => `  ${compactFields(
         { ...r, tags: r.tags.join(",") },
-        ["id", "host", "port", "tlsEnabled", "tags", "rosVersion", "isDefault"]
+        ["id", "host", "port", "deviceType", "tlsEnabled", "tags", "rosVersion", "isDefault"]
       )}`
     );
     return {
@@ -12120,7 +13732,7 @@ function createFleetTools(baseTools2) {
   const checkRouterHealthTool = {
     name: "check_router_health",
     title: "Check Router Health",
-    description: "Probe a router by fetching system/resource. Returns health status, ROS version, uptime, CPU load, and memory info. Unlike other tools, this never throws \u2014 unreachable routers are reported as healthy=false.",
+    description: "Probe a device: RouterOS routers via system/resource, SwOS switches via sys.b. Returns health status, firmware version, uptime, and (RouterOS only) CPU load and memory info. Unlike other tools, this never throws \u2014 unreachable devices are reported as healthy=false.",
     inputSchema: checkHealthInputSchema,
     annotations: {
       readOnlyHint: true,
@@ -12128,13 +13740,13 @@ function createFleetTools(baseTools2) {
       idempotentHint: true,
       openWorldHint: false
     },
+    platform: "any",
     async handler(params, context) {
       checkHealthInputSchema.parse(params);
-      log48.info({ routerId: context.routerId }, "Checking router health");
+      log49.info({ routerId: context.routerId }, "Checking router health");
       const startMs = Date.now();
       try {
-        const resources = await context.routerClient.get("system/resource");
-        const resource = resources[0];
+        const resource = context.swosClient ? swosResourceRecord(await context.swosClient.get("sys.b")) : (await context.routerClient.get("system/resource"))[0];
         const latencyMs = Date.now() - startMs;
         const result = {
           routerId: context.routerId,
@@ -12192,7 +13804,7 @@ function createFleetTools(baseTools2) {
           }
         });
       }
-      log48.info(
+      log49.info(
         { toolName: parsed.toolName, concurrency: parsed.concurrency },
         "bulk_execute invoked"
       );
@@ -12239,7 +13851,7 @@ function createFleetTools(baseTools2) {
           try {
             resolved.push(context.routerRegistry.getRouter(id));
           } catch {
-            log48.warn({ routerId: id }, "bulk_execute: router not found");
+            log49.warn({ routerId: id }, "bulk_execute: router not found");
             preErrors.push({
               routerId: id,
               status: "error",
@@ -12309,6 +13921,7 @@ function createFleetTools(baseTools2) {
         let journalId;
         try {
           checkAuthz(context.identity, parsed.toolName, router.id);
+          assertPlatformMatch(targetTool, router);
           assertMaintenanceWindow(targetTool.annotations.destructiveHint, router, router.id);
           const routerContext = buildRouterToolContext({
             routerConfig: router,
@@ -12320,18 +13933,18 @@ function createFleetTools(baseTools2) {
           });
           const toolParams = { ...parsed.params, routerId: router.id };
           const snapshotIds = [];
-          if (isWrite && targetTool.snapshotPaths && targetTool.snapshotPaths.length > 0) {
-            for (const path of targetTool.snapshotPaths) {
+          if (isWrite) {
+            for (const path of snapshotPathsFor(targetTool, toolParams)) {
               try {
                 const meta = await takeSnapshot(
-                  routerContext.routerClient,
+                  routerContext.deviceClient,
                   router.id,
                   path,
                   snapshotDir
                 );
                 snapshotIds.push(meta.id);
               } catch (err) {
-                log48.warn(
+                log49.warn(
                   { err, path, routerId: router.id },
                   "bulk_execute snapshot failed \u2014 proceeding without snapshot"
                 );
@@ -12472,7 +14085,8 @@ var baseTools = [
   ...logTools,
   ...networkTestTools,
   ...containerConfigTools,
-  ...interfaceListTools
+  ...interfaceListTools,
+  ...swosTools
 ];
 var allTools = [
   ...baseTools,
@@ -12481,12 +14095,12 @@ var allTools = [
 ];
 
 // src/mcp/tool-registry.ts
-var log49 = createLogger("tool-registry");
+var log50 = createLogger("tool-registry");
 function registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry) {
   const deps = { registry, pool, circuitBreakers, config, identityRegistry };
   for (const tool of allTools) {
     const registrationSchema = tool.annotations.destructiveHint ? tool.inputSchema.extend({
-      confirmationToken: z47.string().optional().describe(
+      confirmationToken: z48.string().optional().describe(
         "Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action."
       )
     }) : tool.inputSchema;
@@ -12500,59 +14114,93 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
       },
       (args) => executeToolCall(tool, args, deps)
     );
-    log49.debug({ tool: tool.name }, "Registered tool");
+    log50.debug({ tool: tool.name }, "Registered tool");
   }
-  log49.info({ count: allTools.length }, "All tools registered");
+  log50.info({ count: allTools.length }, "All tools registered");
 }
 
 // src/config/router-registry.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
+import { readFileSync as readFileSync3, existsSync } from "fs";
 import { parse } from "yaml";
-import { z as z48 } from "zod";
-var log50 = createLogger("router-registry");
-var RouterConfigSchema = z48.object({
-  host: z48.string().min(1, "host is required"),
-  port: z48.number().int().min(1).max(65535),
-  tls: z48.object({
-    enabled: z48.boolean(),
-    rejectUnauthorized: z48.boolean(),
-    ca: z48.string().optional(),
-    fingerprint: z48.string().optional()
-  }).strict(),
-  credentials: z48.object({
-    source: z48.enum(["env", "vault"]),
-    envPrefix: z48.string().optional(),
-    vaultPath: z48.string().optional()
+import { z as z49 } from "zod";
+var log51 = createLogger("router-registry");
+var DEVICE_TYPE_ALIASES = {
+  routeros: "routeros",
+  swos: "swos",
+  "swos-lite": "swos"
+};
+var RouterConfigSchema = z49.object({
+  host: z49.string().min(1, "host is required"),
+  port: z49.number().int().min(1).max(65535),
+  deviceType: z49.enum(Object.keys(DEVICE_TYPE_ALIASES)).optional(),
+  tls: z49.object({
+    enabled: z49.boolean(),
+    rejectUnauthorized: z49.boolean(),
+    ca: z49.string().optional(),
+    fingerprint: z49.string().optional()
+  }).strict().optional(),
+  credentials: z49.object({
+    source: z49.enum(["env", "vault"]),
+    envPrefix: z49.string().optional(),
+    vaultPath: z49.string().optional()
   }).strict(),
-  tags: z48.array(z48.string()).default([]),
-  rosVersion: z48.string().min(1),
-  sshPort: z48.number().int().min(1).max(65535).optional(),
-  sshFingerprint: z48.string().optional(),
-  cmdAllow: z48.array(z48.string()).optional(),
-  cmdDeny: z48.array(z48.string()).optional(),
-  maintenanceWindows: z48.array(
-    z48.object({
-      days: z48.array(
-        z48.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
+  tags: z49.array(z49.string()).default([]),
+  rosVersion: z49.string().min(1).optional(),
+  sshPort: z49.number().int().min(1).max(65535).optional(),
+  sshFingerprint: z49.string().optional(),
+  cmdAllow: z49.array(z49.string()).optional(),
+  cmdDeny: z49.array(z49.string()).optional(),
+  maintenanceWindows: z49.array(
+    z49.object({
+      days: z49.array(
+        z49.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
       ),
-      startTime: z48.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
-      endTime: z48.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
-      timezone: z48.string().min(1)
+      startTime: z49.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
+      endTime: z49.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
+      timezone: z49.string().min(1)
     }).strict()
   ).optional()
-}).strict();
-var ConfigFileSchema = z48.object({
-  routers: z48.record(z48.string(), RouterConfigSchema)
+}).strict().superRefine((config, ctx) => {
+  if (deviceTypeOf(config.deviceType) === "routeros") {
+    if (!config.tls) {
+      ctx.addIssue({
+        code: z49.ZodIssueCode.custom,
+        path: ["tls"],
+        message: "tls is required for RouterOS devices"
+      });
+    }
+    if (!config.rosVersion) {
+      ctx.addIssue({
+        code: z49.ZodIssueCode.custom,
+        path: ["rosVersion"],
+        message: "rosVersion is required for RouterOS devices"
+      });
+    }
+    return;
+  }
+  if (config.tls?.enabled) {
+    ctx.addIssue({
+      code: z49.ZodIssueCode.custom,
+      path: ["tls", "enabled"],
+      message: "SwOS devices speak plain HTTP only; tls.enabled must be false"
+    });
+  }
+});
+function deviceTypeOf(configured) {
+  return configured ? DEVICE_TYPE_ALIASES[configured] : "routeros";
+}
+var ConfigFileSchema = z49.object({
+  routers: z49.record(z49.string(), RouterConfigSchema)
 }).strict();
 var RouterRegistry = class {
   routers;
   constructor(configPath) {
     this.routers = /* @__PURE__ */ new Map();
     if (!existsSync(configPath)) {
-      log50.warn({ configPath }, "Router config file not found; starting with empty registry");
+      log51.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
-    const raw = readFileSync2(configPath, "utf-8");
+    const raw = readFileSync3(configPath, "utf-8");
     const parsed = parse(raw);
     const result = ConfigFileSchema.safeParse(parsed);
     if (!result.success) {
@@ -12561,16 +14209,23 @@ var RouterRegistry = class {
 ${issues}`);
     }
     for (const [id, config] of Object.entries(result.data.routers)) {
-      const routerConfig = { ...config, id };
+      const deviceType = deviceTypeOf(config.deviceType);
+      const routerConfig = {
+        ...config,
+        id,
+        deviceType,
+        tls: config.tls ?? { enabled: false, rejectUnauthorized: true },
+        rosVersion: config.rosVersion ?? "swos"
+      };
       if (routerConfig.tls.enabled && !routerConfig.tls.rejectUnauthorized) {
-        log50.warn(
+        log51.warn(
           { routerId: id },
           "TLS certificate validation is DISABLED (rejectUnauthorized=false). Set tls.fingerprint to pin the server certificate instead."
         );
       }
       this.routers.set(id, routerConfig);
     }
-    log50.info({ count: this.routers.size }, "Loaded routers from config");
+    log51.info({ count: this.routers.size }, "Loaded routers from config");
   }
   getRouter(id) {
     const router = this.routers.get(id);
@@ -12598,219 +14253,20 @@ ${issues}`);
 };
 
 // src/adapter/connection-pool.ts
-import { createHash as createHash5 } from "crypto";
-
-// src/adapter/rest-client.ts
-import { request, Agent as Agent2 } from "undici";
-
-// src/adapter/tls-manager.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { buildConnector } from "undici";
-function makePinnedConnector(inner, expectedFingerprint) {
-  const expected = expectedFingerprint.replace(/:/g, "").toLowerCase();
-  return (opts, cb) => {
-    inner(opts, (err, socket) => {
-      if (err || !socket) {
-        cb(err ?? new Error("TLS connection failed"), null);
-        return;
-      }
-      const peer = socket;
-      const cert = typeof peer.getPeerCertificate === "function" ? peer.getPeerCertificate() : void 0;
-      const actual = (cert?.fingerprint256 ?? "").replace(/:/g, "").toLowerCase();
-      if (actual !== expected) {
-        socket.destroy();
-        cb(
-          new Error(
-            `TLS certificate fingerprint mismatch. Expected: ${expected}, got: ${actual || "none"}`
-          ),
-          null
-        );
-        return;
-      }
-      cb(null, socket);
-    });
-  };
-}
-function buildAgentOptions(tls) {
-  if (!tls.enabled) {
-    return {};
-  }
-  const connectOptions = {
-    rejectUnauthorized: tls.rejectUnauthorized
-  };
-  if (tls.ca) {
-    connectOptions.ca = readFileSync3(tls.ca, "utf-8");
-  }
-  if (tls.fingerprint) {
-    const inner = buildConnector(connectOptions);
-    return { connect: makePinnedConnector(inner, tls.fingerprint) };
-  }
-  return {
-    connect: connectOptions
-  };
-}
-
-// src/adapter/query-builder.ts
-function buildListQuery(options) {
-  if (!options) {
-    return { method: "GET" };
-  }
-  const hasFilter = options.filter && Object.keys(options.filter).length > 0;
-  const hasProplist = options.proplist && options.proplist.length > 0;
-  if (hasProplist) {
-    const body = {};
-    if (hasProplist) {
-      body[".proplist"] = options.proplist.join(",");
-    }
-    if (hasFilter) {
-      const queryParts = [];
-      for (const [key2, value] of Object.entries(options.filter)) {
-        queryParts.push(`${key2}=${value}`);
-      }
-      body[".query"] = queryParts;
-    }
-    return { method: "POST", body };
-  }
-  if (hasFilter) {
-    const queryParams = {};
-    for (const [key2, value] of Object.entries(options.filter)) {
-      queryParams[key2] = value;
-    }
-    return { method: "GET", queryParams };
-  }
-  return { method: "GET" };
-}
-function applyPagination(items, limit2, offset2) {
-  const total = items.length;
-  const start = offset2 ?? 0;
-  const sliced = limit2 !== void 0 ? items.slice(start, start + limit2) : items.slice(start);
-  return {
-    items: sliced,
-    total,
-    hasMore: start + sliced.length < total
-  };
+import { createHash as createHash6 } from "crypto";
+function credentialHash(credentials) {
+  return createHash6("sha256").update(`${credentials.username}\0${credentials.password}`).digest("hex");
 }
-
-// src/adapter/rest-client.ts
-var HttpError = class extends Error {
-  statusCode;
-  responseBody;
-  constructor(statusCode, responseBody) {
-    super(`HTTP ${statusCode}: ${responseBody}`);
-    this.name = "HttpError";
-    this.statusCode = statusCode;
-    this.responseBody = responseBody;
-  }
-};
-var REQUEST_TIMEOUT_MS = 3e4;
-var RouterOSRestClient = class {
-  baseUrl;
-  authHeader;
-  agent;
-  constructor(config, credentials) {
-    const scheme = config.tls.enabled ? "https" : "http";
-    this.baseUrl = `${scheme}://${config.host}:${config.port}/rest`;
-    this.authHeader = "Basic " + Buffer.from(`${credentials.username}:${credentials.password}`).toString("base64");
-    this.agent = new Agent2(buildAgentOptions(config.tls));
-  }
-  // ---------- public CRUD methods ----------
-  /**
-   * List resources at the given path.
-   *
-   * Applies filtering via GET query params or POST body depending on the
-   * query complexity, then runs client-side pagination.
-   */
-  async get(path, options) {
-    const query = buildListQuery(options);
-    let raw;
-    if (query.method === "POST") {
-      raw = await this.doRequest("POST", `${this.baseUrl}/${path}`, query.body);
-    } else {
-      const qs = query.queryParams ? "?" + new URLSearchParams(query.queryParams).toString() : "";
-      raw = await this.doRequest("GET", `${this.baseUrl}/${path}${qs}`);
-    }
-    const rawArray = Array.isArray(raw) ? raw : [raw];
-    const parsed = parseRecords(rawArray);
-    if (options?.limit !== void 0 || options?.offset !== void 0) {
-      const page = applyPagination(parsed, options?.limit, options?.offset);
-      return page.items;
-    }
-    return parsed;
-  }
-  /** Fetch a single resource by its RouterOS `.id`. */
-  async getOne(path, id) {
-    const raw = await this.doRequest("GET", `${this.baseUrl}/${path}/${id}`);
-    return parseRecord(raw);
-  }
-  /** Create a new resource (PUT). Returns the created record including `.id`. */
-  async create(path, data) {
-    const raw = await this.doRequest("PUT", `${this.baseUrl}/${path}`, data);
-    return raw;
-  }
-  /** Update an existing resource by `.id` (PATCH). */
-  async update(path, id, data) {
-    await this.doRequest("PATCH", `${this.baseUrl}/${path}/${id}`, data);
-  }
-  /** Remove a resource by `.id` (DELETE). */
-  async remove(path, id) {
-    await this.doRequest("DELETE", `${this.baseUrl}/${path}/${id}`);
-  }
-  /** Execute a command (POST), e.g. `/ip/firewall/filter/print`. */
-  async execute(path, data) {
-    const result = await this.doRequest("POST", `${this.baseUrl}/${path}`, data);
-    return result;
-  }
-  // ---------- lifecycle ----------
-  /** Close the underlying HTTP agent and free resources. */
-  close() {
-    this.agent.close();
-  }
-  // ---------- internal ----------
-  /**
-   * Core HTTP request method.
-   *
-   * - Sends JSON body when provided.
-   * - Attaches Basic Auth and content-type headers.
-   * - Throws `HttpError` on non-2xx status codes.
-   * - Returns parsed JSON (or `undefined` for empty bodies).
-   */
-  async doRequest(method, url, body) {
-    const headers = {
-      Accept: "application/json",
-      Authorization: this.authHeader
-    };
-    let requestBody;
-    if (body !== void 0) {
-      headers["Content-Type"] = "application/json";
-      requestBody = JSON.stringify(body);
-    }
-    const response = await request(url, {
-      method,
-      headers,
-      body: requestBody,
-      dispatcher: this.agent,
-      bodyTimeout: REQUEST_TIMEOUT_MS,
-      headersTimeout: REQUEST_TIMEOUT_MS
-    });
-    const text = await response.body.text();
-    if (response.statusCode < 200 || response.statusCode >= 300) {
-      throw new HttpError(response.statusCode, text);
-    }
-    if (!text || text.length === 0) {
-      return void 0;
-    }
-    return JSON.parse(text);
+function createDeviceClient(config, credentials) {
+  if (config.deviceType === "swos") {
+    return new SwosClient(config.host, config.port, credentials);
   }
-};
-
-// src/adapter/connection-pool.ts
-function credentialHash(credentials) {
-  return createHash5("sha256").update(`${credentials.username}\0${credentials.password}`).digest("hex");
+  return new RouterOSRestClient(config, credentials);
 }
 var ConnectionPool = class {
   clients = /* @__PURE__ */ new Map();
   /**
-   * Get an existing client for the given router or create a new one. Clients are
+   * Get an existing client for the given device or create a new one. Clients are
    * keyed by `config.id`, but a client whose credentials no longer match the
    * request is closed and rebuilt so rotated credentials take effect.
    */
@@ -12823,7 +14279,7 @@ var ConnectionPool = class {
       }
       existing.client.close();
     }
-    const client = new RouterOSRestClient(config, credentials);
+    const client = createDeviceClient(config, credentials);
     this.clients.set(config.id, { client, credHash });
     return client;
   }
@@ -12861,16 +14317,17 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.8.0";
+var VERSION = "1.9.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
-  "MikroMCP manages MikroTik RouterOS devices.",
+  "MikroMCP manages MikroTik RouterOS routers and SwOS switches.",
   "Reads are safe; treat writes as consequential \u2014 preview a write with dryRun:true and review the diff before applying.",
   "Destructive operations may require a two-step confirmation token.",
   "Writes are idempotent: already_exists and no_change are success, not errors.",
   "Prefer dedicated tools over run_command.",
   "routerId is optional when a default router is configured.",
+  "Check list_routers first: swos devices take the swos_* tools, RouterOS devices take everything else.",
   "For the full operating playbook, install the MikroMCP usage skill."
 ].join(" ");
 function createServerFactory(config, identityRegistry) {
@@ -12903,7 +14360,7 @@ import { randomUUID } from "crypto";
 import { createServer } from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-var log51 = createLogger("transport-http");
+var log52 = createLogger("transport-http");
 var SESSION_TTL_MS = 30 * 6e4;
 var BodyTooLargeError = class extends Error {
   constructor() {
@@ -12988,7 +14445,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
       if (now - session.lastSeenMs > SESSION_TTL_MS) {
         streamableSessions.delete(id);
         session.transport.close();
-        log51.info({ sessionId: id }, "Streamable HTTP session expired (idle TTL)");
+        log52.info({ sessionId: id }, "Streamable HTTP session expired (idle TTL)");
       }
     }
   }, 6e4);
@@ -13023,7 +14480,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
       return;
     }
     if (!checkRateLimit(ip)) {
-      log51.warn({ ip }, "Rate limit exceeded");
+      log52.warn({ ip }, "Rate limit exceeded");
       res.writeHead(429, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Too many requests. Retry after 60 seconds." }));
       return;
@@ -13068,7 +14525,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
         }
         return;
       }
-      log51.error({ err }, "HTTP transport error");
+      log52.error({ err }, "HTTP transport error");
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Internal server error" }));
@@ -13081,7 +14538,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
   });
   await new Promise((resolve, reject) => {
     httpServer.listen(port, bindHost, () => {
-      log51.info(
+      log52.info(
         { port, bindHost },
         "HTTP transport listening (POST /mcp for Streamable HTTP, GET /sse for legacy SSE)"
       );
@@ -13114,13 +14571,13 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (id) => {
           streamableSessions.set(id, { transport: transport2, identityId, lastSeenMs: Date.now() });
-          log51.info({ sessionId: id, identityId }, "Streamable HTTP session created");
+          log52.info({ sessionId: id, identityId }, "Streamable HTTP session created");
         }
       });
       transport2.onclose = () => {
         if (transport2.sessionId) {
           streamableSessions.delete(transport2.sessionId);
-          log51.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
+          log52.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
         }
       };
       await makeServer().connect(transport2);
@@ -13137,7 +14594,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
     sseTransport.onclose = () => {
       sseTransports.delete(sseTransport.sessionId);
     };
-    log51.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
+    log52.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
     await sseTransport.start();
     return;
   }
@@ -13157,19 +14614,19 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 
 // src/config/identity-registry.ts
 import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { parse as parse2 } from "yaml";
-import { z as z49 } from "zod";
+import { z as z50 } from "zod";
 import bcrypt from "bcryptjs";
-var log52 = createLogger("identity-registry");
-var IdentityConfigSchema = z49.object({
-  token: z49.string().min(1, "token hash is required"),
-  role: z49.enum(["readonly", "operator", "admin", "superadmin"]),
-  allowedRouters: z49.array(z49.string()).default([]),
-  allowedToolPatterns: z49.array(z49.string()).default([])
+var log53 = createLogger("identity-registry");
+var IdentityConfigSchema = z50.object({
+  token: z50.string().min(1, "token hash is required"),
+  role: z50.enum(["readonly", "operator", "admin", "superadmin"]),
+  allowedRouters: z50.array(z50.string()).default([]),
+  allowedToolPatterns: z50.array(z50.string()).default([])
 }).strict();
-var ConfigFileSchema2 = z49.object({
-  identities: z49.record(z49.string(), IdentityConfigSchema)
+var ConfigFileSchema2 = z50.object({
+  identities: z50.record(z50.string(), IdentityConfigSchema)
 }).strict();
 var IdentityRegistry = class {
   identities = [];
@@ -13178,7 +14635,7 @@ var IdentityRegistry = class {
   tokenCache = /* @__PURE__ */ new Map();
   constructor(configPath) {
     if (!existsSync2(configPath)) {
-      log52.warn(
+      log53.warn(
         { configPath },
         "Identity config file not found; starting with empty registry (stdio callers do not require it)"
       );
@@ -13201,7 +14658,7 @@ ${issues}`);
         allowedToolPatterns: config.allowedToolPatterns
       });
     }
-    log52.info({ count: this.identities.length }, "Loaded identities from config");
+    log53.info({ count: this.identities.length }, "Loaded identities from config");
   }
   getIdentities() {
     return this.identities.map(({ id, role, allowedRouters, allowedToolPatterns }) => ({
@@ -13212,7 +14669,7 @@ ${issues}`);
     }));
   }
   async findIdentityByToken(token) {
-    const cacheKey = createHash6("sha256").update(token).digest("hex");
+    const cacheKey = createHash7("sha256").update(token).digest("hex");
     const toIdentity = (stored) => ({
       id: stored.id,
       role: stored.role,
@@ -13239,7 +14696,7 @@ ${issues}`);
 // src/domain/snapshot/retention.ts
 import { readdir, stat, unlink } from "fs/promises";
 import { join as join3 } from "path";
-var log53 = createLogger("snapshot-retention");
+var log54 = createLogger("snapshot-retention");
 async function pruneSnapshots(snapshotDir, maxAgeDays) {
   const cutoffMs = Date.now() - maxAgeDays * 864e5;
   let removed = 0;
@@ -13266,21 +14723,21 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
           removed++;
         }
       } catch (err) {
-        log53.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
+        log54.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
       }
     }
   }
   if (removed > 0) {
-    log53.info({ removed, maxAgeDays }, "Pruned expired snapshots");
+    log54.info({ removed, maxAgeDays }, "Pruned expired snapshots");
   }
   return removed;
 }
 
 // src/cli/serve.ts
-var log54 = createLogger("main");
+var log55 = createLogger("main");
 async function runServe() {
   const config = loadAppConfig();
-  log54.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
+  log55.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
@@ -13288,7 +14745,7 @@ async function runServe() {
       (i) => i.role === "readonly" || i.role === "operator"
     );
     if (hasLimitedRoles && !config.confirmationSecret) {
-      log54.error(
+      log55.error(
         "MIKROMCP_CONFIRMATION_SECRET is required in HTTP mode when identities with role readonly or operator are configured"
       );
       process.exit(1);
@@ -13298,7 +14755,7 @@ async function runServe() {
   if (config.transport === "stdio") {
     const stdioIdentity = getStdioIdentity(config.stdioIdentity, identityRegistry);
     await withIdentity(stdioIdentity, () => connectStdio(makeServer()));
-    log54.info("MikroMCP server running via stdio");
+    log55.info("MikroMCP server running via stdio");
   } else if (config.transport === "http") {
     await connectHttp(
       makeServer,
@@ -13310,13 +14767,13 @@ async function runServe() {
       },
       identityRegistry
     );
-    log54.info(
+    log55.info(
       { port: config.port, bindHost: config.bindHost },
       "MikroMCP server running via HTTP/SSE"
     );
   }
   const shutdown = () => {
-    log54.info("Shutting down MikroMCP server");
+    log55.info("Shutting down MikroMCP server");
     pool.closeAll();
     process.exit(0);
   };
@@ -13329,7 +14786,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.8.0";
+var localVersion = "1.9.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -13634,7 +15091,7 @@ async function runDoctor() {
 
 // src/cli/init.ts
 import { input, confirm, select } from "@inquirer/prompts";
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import {
   existsSync as existsSync4,
   readFileSync as readFileSync6,
@@ -13789,7 +15246,7 @@ async function collectIdentityInfo() {
     message: "Allowed tool patterns (comma-separated or * for all):",
     default: "*"
   });
-  const rawToken = randomBytes(32).toString("hex");
+  const rawToken = randomBytes2(32).toString("hex");
   console.log(chalk2.green(`
   Generated token: ${chalk2.bold(rawToken)}`));
   console.log(chalk2.yellow("  \u26A0  Save this token \u2014 it will NOT be shown again.\n"));
@@ -13883,7 +15340,7 @@ function writeDotEnv(data) {
   const userKey = `${data.envPrefix}_USER`;
   const passKey = `${data.envPrefix}_PASS`;
   const auditLogPath = defaultAuditLogPath();
-  const confirmationSecret = data.transport === "http" ? randomBytes(32).toString("hex") : "";
+  const confirmationSecret = data.transport === "http" ? randomBytes2(32).toString("hex") : "";
   const lines = [
     "# \u2500\u2500 Router credentials \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
     `${userKey}=${data.routerUser}`,
@@ -13952,11 +15409,11 @@ async function runInit() {
   const configDir = mikromcpDir2();
   const envPath = join4(configDir, ".env");
   const existingFiles = [".env", "routers.yaml", "identities.yaml"].filter(
-    (f) => existsSync4(join4(configDir, f))
+    (f2) => existsSync4(join4(configDir, f2))
   );
   if (existingFiles.length > 0) {
     console.log(chalk2.yellow(`  \u26A0  Found existing files in ${configDir}:`));
-    for (const f of existingFiles) console.log(chalk2.yellow(`       ${f}`));
+    for (const f2 of existingFiles) console.log(chalk2.yellow(`       ${f2}`));
     console.log();
     const proceed = await confirm({
       message: "Continue? (existing files will be overwritten or merged)",
@@ -14041,7 +15498,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.8.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.9.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);