mikromcp 1.9.0 → 1.11.0

package/dist/main.js

@@ -498,6 +498,9 @@ function parseRouterOSValue(key2, value) {
 function isTrue(v) {
   return v === true || v === "true" || v === "yes";
 }
+function sameValue(recordValue, desired) {
+  return String(recordValue) === String(desired);
+}
 function parseRecord(raw) {
   const parsed = {};
   for (const [key2, value] of Object.entries(raw)) {
@@ -602,12 +605,18 @@ var listInterfacesTool = {
           return true;
         });
       }
-      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
+      const {
+        items: paginated,
+        total,
+        hasMore
+      } = paginate(interfaces, parsed.offset, parsed.limit);
       const results2 = paginated.map((iface) => {
         const rec = iface;
         const isRunning2 = isTrue(rec.running);
         const isDisabled = isTrue(rec.disabled);
-        const enriched = { status: isDisabled ? "disabled" : isRunning2 ? "up" : "down" };
+        const enriched = {
+          status: isDisabled ? "disabled" : isRunning2 ? "up" : "down"
+        };
         for (const [key2, value] of Object.entries(rec)) {
           if (parsed.includeCounters || !COUNTER_PROPS.includes(key2)) {
             enriched[key2] = value;
@@ -809,9 +818,13 @@ var manageIpAddressTool = {
         const changes = {};
         const diff = [];
         const disabledStr = parsed.disabled ? "true" : "false";
-        if (rec.disabled !== disabledStr) {
+        if (isTrue(rec.disabled) !== parsed.disabled) {
           changes.disabled = disabledStr;
-          diff.push({ property: "disabled", before: rec.disabled ?? null, after: disabledStr });
+          diff.push({
+            property: "disabled",
+            before: rec.disabled === void 0 ? null : String(rec.disabled),
+            after: disabledStr
+          });
         }
         if (comment !== void 0 && (rec.comment ?? "") !== comment) {
           changes.comment = comment;
@@ -1038,7 +1051,11 @@ var manageDhcpLeaseTool = {
         if (isAlreadyStatic) {
           return {
             content: `Lease for ${upperMac} (${existing.address ?? "unknown"}) is already static. No changes made.`,
-            structuredContent: { action: "already_static", macAddress: upperMac, id: existing[".id"] }
+            structuredContent: {
+              action: "already_static",
+              macAddress: upperMac,
+              id: existing[".id"]
+            }
           };
         }
         if (parsed.dryRun) {
@@ -1144,7 +1161,14 @@ var listRoutesTool = {
           paginated,
           total,
           parsed.offset,
-          (r) => compactFields(r, ["dst-address", "gateway", "distance", "routing-table", "active", "disabled"])
+          (r) => compactFields(r, [
+            "dst-address",
+            "gateway",
+            "distance",
+            "routing-table",
+            "active",
+            "disabled"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -1221,9 +1245,9 @@ var manageRouteTool = {
       if (parsed.action === "add") {
         if (existing) {
           const rec = existing;
-          const existingDistance = rec.distance ?? "1";
+          const existingDistance = String(rec.distance ?? "1");
           const existingDisabled = isTrue(rec.disabled);
-          const sameDistance = existingDistance === String(parsed.distance);
+          const sameDistance = sameValue(rec.distance ?? 1, parsed.distance);
           const sameDisabled = existingDisabled === parsed.disabled;
           if (sameDistance && sameDisabled) {
             return {
@@ -1681,13 +1705,51 @@ var firewallTools = [listFirewallRulesTool, manageFirewallRuleTool];
 
 // src/domain/tools/diagnostic-tools.ts
 import { z as z9 } from "zod";
+
+// src/adapter/routeros-command.ts
+var ROUTEROS_COMMAND = /^\/[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*)+$/;
+var ROUTEROS_PARAMETER = /^[a-z][a-z0-9-]*$/;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+function isRouterOsCommandString(value) {
+  return !CONTROL_CHARACTER.test(value);
+}
+function quoteRouterOsString(value) {
+  if (!isRouterOsCommandString(value)) {
+    throw new Error("RouterOS command values must not contain control characters");
+  }
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$");
+  return `"${escaped}"`;
+}
+function buildRouterOsCommand(command, parameters) {
+  if (!ROUTEROS_COMMAND.test(command)) {
+    throw new Error("Invalid RouterOS command");
+  }
+  const parts = [command];
+  for (const [name, value] of Object.entries(parameters)) {
+    if (!ROUTEROS_PARAMETER.test(name)) {
+      throw new Error("Invalid RouterOS parameter");
+    }
+    if (typeof value === "number") {
+      if (!Number.isSafeInteger(value)) {
+        throw new Error("RouterOS numeric command values must be safe integers");
+      }
+      parts.push(`${name}=${value}`);
+    } else {
+      parts.push(`${name}=${quoteRouterOsString(value)}`);
+    }
+  }
+  return parts.join(" ");
+}
+
+// src/domain/tools/diagnostic-tools.ts
 var log7 = createLogger("diagnostic-tools");
+var routerOsCommandString = z9.string().refine(isRouterOsCommandString, "Must not contain control characters");
 var pingInputSchema = z9.object({
   routerId,
-  address: z9.string().describe("Target IP address or hostname to ping"),
+  address: routerOsCommandString.describe("Target IP address or hostname to ping"),
   count: z9.number().int().min(1).max(20).default(4).describe("Number of ICMP echo requests (1\u201320)"),
   size: z9.number().int().min(14).max(65535).default(56).describe("Packet size in bytes (14\u201365535)"),
-  routingTable: z9.string().optional().describe("Routing table to use for the ping")
+  routingTable: routerOsCommandString.optional().describe("Routing table to use for the ping")
 }).strict();
 var pingTool = {
   name: "ping",
@@ -1704,13 +1766,15 @@ var pingTool = {
     const parsed = pingInputSchema.parse(params);
     log7.info({ routerId: context.routerId, address: parsed.address }, "Pinging");
     try {
-      const parts = [
-        `/tool ping address=${parsed.address}`,
-        `count=${parsed.count}`,
-        `size=${parsed.size}`
-      ];
-      if (parsed.routingTable !== void 0) parts.push(`routing-table=${parsed.routingTable}`);
-      const output = await context.sshClient.execute(parts.join(" "));
+      const parameters = {
+        address: parsed.address,
+        count: parsed.count,
+        size: parsed.size
+      };
+      if (parsed.routingTable !== void 0) parameters["routing-table"] = parsed.routingTable;
+      const output = await context.sshClient.execute(
+        buildRouterOsCommand("/tool ping", parameters)
+      );
       const s = output.match(/sent=(\d+)/)?.[1] ?? String(parsed.count);
       const r = output.match(/received=(\d+)/)?.[1] ?? "0";
       const loss = output.match(/packet-loss=(\S+)/)?.[1] ?? "100%";
@@ -1738,7 +1802,7 @@ var pingTool = {
 };
 var tracerouteInputSchema = z9.object({
   routerId,
-  address: z9.string().describe("Target IP address or hostname to trace"),
+  address: routerOsCommandString.describe("Target IP address or hostname to trace"),
   count: z9.number().int().min(1).max(5).default(3).describe("Probes per hop (1\u20135)"),
   maxHops: z9.number().int().min(1).max(30).default(15).describe("Maximum number of hops (1\u201330)")
 }).strict();
@@ -1757,12 +1821,13 @@ var tracerouteTool = {
     const parsed = tracerouteInputSchema.parse(params);
     log7.info({ routerId: context.routerId, address: parsed.address }, "Tracerouting");
     try {
-      const parts = [
-        `/tool traceroute address=${parsed.address}`,
-        `count=${parsed.count}`,
-        `max-hops=${parsed.maxHops}`
-      ];
-      const output = await context.sshClient.execute(parts.join(" "));
+      const output = await context.sshClient.execute(
+        buildRouterOsCommand("/tool traceroute", {
+          address: parsed.address,
+          count: parsed.count,
+          "max-hops": parsed.maxHops
+        })
+      );
       const hopLines = output.split("\n").filter((l) => /^\s*\d+\s+\S+/.test(l));
       const hops = hopLines.map((line) => {
         const cols = line.trim().split(/\s+/);
@@ -1793,10 +1858,10 @@ var tracerouteTool = {
 };
 var torchInputSchema = z9.object({
   routerId,
-  interface: z9.string().describe("Interface name to monitor (e.g. ether1, bridge1)"),
+  interface: routerOsCommandString.describe("Interface name to monitor (e.g. ether1, bridge1)"),
   duration: z9.number().int().min(1).max(30).default(5).describe("Capture duration in seconds (1\u201330)"),
-  srcAddress: z9.string().optional().describe("Filter by source IP address"),
-  dstAddress: z9.string().optional().describe("Filter by destination IP address")
+  srcAddress: routerOsCommandString.optional().describe("Filter by source IP address"),
+  dstAddress: routerOsCommandString.optional().describe("Filter by destination IP address")
 }).strict();
 function parseTorchOutput(output) {
   const flows = [];
@@ -1829,10 +1894,13 @@ var torchTool = {
     const parsed = torchInputSchema.parse(params);
     log7.info({ routerId: context.routerId, interface: parsed.interface }, "Running torch");
     try {
-      const parts = [`/tool torch interface=${parsed.interface}`];
-      if (parsed.srcAddress !== void 0) parts.push(`src-address=${parsed.srcAddress}`);
-      if (parsed.dstAddress !== void 0) parts.push(`dst-address=${parsed.dstAddress}`);
-      const raw = await context.sshClient.execute(parts.join(" "), (parsed.duration + 1) * 1e3);
+      const parameters = { interface: parsed.interface };
+      if (parsed.srcAddress !== void 0) parameters["src-address"] = parsed.srcAddress;
+      if (parsed.dstAddress !== void 0) parameters["dst-address"] = parsed.dstAddress;
+      const raw = await context.sshClient.execute(
+        buildRouterOsCommand("/tool torch", parameters),
+        (parsed.duration + 1) * 1e3
+      );
       const clean = raw.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
       const flows = parseTorchOutput(clean);
       const lines = [
@@ -1927,7 +1995,14 @@ function parseRouterClock(dateStr, timeStr) {
   const ss = parseInt(time[3], 10);
   const iso = /^(\d{4})-(\d{2})-(\d{2})$/.exec(dateStr);
   if (iso) {
-    return new Date(parseInt(iso[1], 10), parseInt(iso[2], 10) - 1, parseInt(iso[3], 10), hh, mm, ss);
+    return new Date(
+      parseInt(iso[1], 10),
+      parseInt(iso[2], 10) - 1,
+      parseInt(iso[3], 10),
+      hh,
+      mm,
+      ss
+    );
   }
   const named = /^([a-z]{3})\/(\d{2})\/(\d{4})$/i.exec(dateStr);
   if (named) {
@@ -1963,7 +2038,8 @@ var getLogTool = {
           const clock = Array.isArray(clockResult) ? clockResult[0] : clockResult;
           const routerNow = parseRouterClock(clock?.date, clock?.time);
           if (routerNow !== null) now = routerNow;
-          else log7.warn({ routerId: context.routerId }, "Unparseable router clock; using host clock");
+          else
+            log7.warn({ routerId: context.routerId }, "Unparseable router clock; using host clock");
         } catch {
           log7.warn({ routerId: context.routerId }, "Router clock unavailable; using host clock");
         }
@@ -2077,9 +2153,7 @@ function checkCommand(command, policy) {
   }
   if (policy.allow.length > 0) {
     const normAllow = policy.allow.map((p) => normalizeCommand(p));
-    const everySegmentAllowed = normSegs.every(
-      (seg) => normAllow.some((p) => globMatch(p, seg))
-    );
+    const everySegmentAllowed = normSegs.every((seg) => normAllow.some((p) => globMatch(p, seg)));
     if (!everySegmentAllowed) {
       throw new MikroMCPError({
         category: "VALIDATION" /* VALIDATION */,
@@ -2350,7 +2424,14 @@ var listBridgesTool = {
           paginated,
           total,
           parsed.offset,
-          (b) => compactFields(b, ["name", "protocol-mode", "vlan-filtering", "mtu", "disabled", "comment"])
+          (b) => compactFields(b, [
+            "name",
+            "protocol-mode",
+            "vlan-filtering",
+            "mtu",
+            "disabled",
+            "comment"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -2601,7 +2682,11 @@ var listWifiTool = {
         limit: void 0,
         offset: void 0
       });
-      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
+      const {
+        items: paginated,
+        total,
+        hasMore
+      } = paginate(interfaces, parsed.offset, parsed.limit);
       return {
         content: listContent(
           "WiFi interfaces",
@@ -2725,16 +2810,22 @@ var manageWifiTool = {
       const rec = existing[0];
       const changes = {};
       const diff = [];
-      if (parsed.disabled !== void 0) {
+      if (parsed.disabled !== void 0 && isTrue(rec.disabled) !== parsed.disabled) {
         const desired = parsed.disabled ? "true" : "false";
-        if (rec.disabled !== desired) {
-          changes.disabled = desired;
-          diff.push({ property: "disabled", before: rec.disabled ?? null, after: desired });
-        }
+        changes.disabled = desired;
+        diff.push({
+          property: "disabled",
+          before: rec.disabled === void 0 ? null : String(rec.disabled),
+          after: desired
+        });
       }
-      if (parsed.ssid !== void 0 && rec.ssid !== parsed.ssid) {
+      if (parsed.ssid !== void 0 && !sameValue(rec.ssid, parsed.ssid)) {
         changes.ssid = parsed.ssid;
-        diff.push({ property: "ssid", before: rec.ssid ?? null, after: parsed.ssid });
+        diff.push({
+          property: "ssid",
+          before: rec.ssid === void 0 ? null : String(rec.ssid),
+          after: parsed.ssid
+        });
       }
       if (diff.length === 0) {
         return {
@@ -2788,7 +2879,11 @@ var listWgTool = {
         limit: void 0,
         offset: void 0
       });
-      const { items: paginated, total, hasMore } = paginate(interfaces, parsed.offset, parsed.limit);
+      const {
+        items: paginated,
+        total,
+        hasMore
+      } = paginate(interfaces, parsed.offset, parsed.limit);
       return {
         content: listContent(
           "WireGuard interfaces",
@@ -2848,7 +2943,13 @@ var listPeersTool = {
           peers,
           total,
           parsed.offset,
-          (p) => compactFields(p, ["interface", "public-key", "endpoint-address", "allowed-address", "disabled"])
+          (p) => compactFields(p, [
+            "interface",
+            "public-key",
+            "endpoint-address",
+            "allowed-address",
+            "disabled"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -3018,10 +3119,7 @@ var manageWgIfaceTool = {
         const body = { name: parsed.name, mtu: String(parsed.mtu) };
         if (parsed.listenPort !== void 0) body["listen-port"] = String(parsed.listenPort);
         if (parsed.comment) body.comment = parsed.comment;
-        const created = await context.routerClient.create(
-          "interface/wireguard",
-          body
-        );
+        const created = await context.routerClient.create("interface/wireguard", body);
         log11.info({ name: parsed.name, id: created[".id"] }, "WireGuard interface created");
         return {
           content: `Created WireGuard interface "${parsed.name}". Public key: ${created["public-key"] ?? "unknown"}`,
@@ -3366,7 +3464,6 @@ var manageDnsSettingsTool = {
     try {
       const results2 = await context.routerClient.get("ip/dns");
       const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
-      const id = current[".id"];
       const changes = {};
       const diff = [];
       if (parsed.servers !== void 0 && current.servers !== parsed.servers) {
@@ -3375,27 +3472,43 @@ var manageDnsSettingsTool = {
       }
       if (parsed.allowRemoteRequests !== void 0) {
         const next = String(parsed.allowRemoteRequests);
-        if (current["allow-remote-requests"] !== next) {
+        if (isTrue(current["allow-remote-requests"]) !== parsed.allowRemoteRequests) {
           changes["allow-remote-requests"] = next;
-          diff.push({ property: "allow-remote-requests", before: current["allow-remote-requests"] ?? null, after: next });
+          diff.push({
+            property: "allow-remote-requests",
+            before: current["allow-remote-requests"] === void 0 ? null : String(current["allow-remote-requests"]),
+            after: next
+          });
         }
       }
       if (parsed.maxUdpPacketSize !== void 0) {
         const next = String(parsed.maxUdpPacketSize);
-        if (current["max-udp-packet-size"] !== next) {
+        if (!sameValue(current["max-udp-packet-size"], next)) {
           changes["max-udp-packet-size"] = next;
-          diff.push({ property: "max-udp-packet-size", before: current["max-udp-packet-size"] ?? null, after: next });
+          diff.push({
+            property: "max-udp-packet-size",
+            before: current["max-udp-packet-size"] === void 0 ? null : String(current["max-udp-packet-size"]),
+            after: next
+          });
         }
       }
       if (parsed.cacheMaxTtl !== void 0 && current["cache-max-ttl"] !== parsed.cacheMaxTtl) {
         changes["cache-max-ttl"] = parsed.cacheMaxTtl;
-        diff.push({ property: "cache-max-ttl", before: current["cache-max-ttl"] ?? null, after: parsed.cacheMaxTtl });
+        diff.push({
+          property: "cache-max-ttl",
+          before: current["cache-max-ttl"] ?? null,
+          after: parsed.cacheMaxTtl
+        });
       }
       if (parsed.cacheSize !== void 0) {
         const next = String(parsed.cacheSize);
-        if (current["cache-size"] !== next) {
+        if (!sameValue(current["cache-size"], next)) {
           changes["cache-size"] = next;
-          diff.push({ property: "cache-size", before: current["cache-size"] ?? null, after: next });
+          diff.push({
+            property: "cache-size",
+            before: current["cache-size"] === void 0 ? null : String(current["cache-size"]),
+            after: next
+          });
         }
       }
       if (Object.keys(changes).length === 0) {
@@ -3410,8 +3523,11 @@ var manageDnsSettingsTool = {
           structuredContent: { action: "dry_run", diff }
         };
       }
-      await context.routerClient.update("ip/dns", id, changes);
-      log12.info({ routerId: context.routerId, changes: Object.keys(changes) }, "DNS settings updated");
+      await context.routerClient.execute("ip/dns/set", changes);
+      log12.info(
+        { routerId: context.routerId, changes: Object.keys(changes) },
+        "DNS settings updated"
+      );
       return {
         content: `Updated DNS settings on ${context.routerId}.`,
         structuredContent: { action: "updated", routerId: context.routerId, diff }
@@ -3421,7 +3537,12 @@ var manageDnsSettingsTool = {
     }
   }
 };
-var dnsTools = [listDnsTool, manageDnsTool, getDnsSettingsTool, manageDnsSettingsTool];
+var dnsTools = [
+  listDnsTool,
+  manageDnsTool,
+  getDnsSettingsTool,
+  manageDnsSettingsTool
+];
 
 // src/domain/tools/mangle-tools.ts
 import { z as z15 } from "zod";
@@ -3905,7 +4026,14 @@ var listRoutingRulesTool = {
           rules,
           rules.length,
           0,
-          (r) => compactFields(r, ["src-address", "dst-address", "action", "table", "interface", "disabled"])
+          (r) => compactFields(r, [
+            "src-address",
+            "dst-address",
+            "action",
+            "table",
+            "interface",
+            "disabled"
+          ])
         ),
         structuredContent: { routerId: context.routerId, rules, total: rules.length }
       };
@@ -5050,7 +5178,7 @@ var uploadFileInputSchema = z22.object({
   routerId,
   name: z22.string().describe("Target filename on the router (e.g. flash/my-script.rsc)"),
   content: z22.string().describe("File content to upload (text)"),
-  dryRun: z22.boolean().default(false).describe("Validate FTP connectivity without writing the file")
+  dryRun: z22.boolean().default(false).describe("Validate SFTP or FTP connectivity without writing the target file")
 }).strict();
 var uploadFileTool = {
   name: "upload_file",
@@ -5074,14 +5202,27 @@ var uploadFileTool = {
           await context.sftpClient.upload(`${parsed.name}.mikromcp-probe`, "");
           return {
             content: `Dry run: SFTP connectivity to ${context.routerId} verified. Would upload "${parsed.name}".`,
-            structuredContent: { action: "dry_run", transport: "sftp", name: parsed.name, routerId: context.routerId }
+            structuredContent: {
+              action: "dry_run",
+              transport: "sftp",
+              name: parsed.name,
+              routerId: context.routerId
+            }
           };
         } catch (sftpErr) {
-          log20.warn({ err: sftpErr, routerId: context.routerId }, "SFTP dry-run probe failed \u2014 falling back to FTP");
+          log20.warn(
+            { err: sftpErr, routerId: context.routerId },
+            "SFTP dry-run probe failed \u2014 falling back to FTP"
+          );
           await context.ftpClient.connect();
           return {
             content: `Dry run: FTP connectivity to ${context.routerId} verified${ftpPlaintextNote}. Would upload "${parsed.name}".`,
-            structuredContent: { action: "dry_run", transport: "ftp", name: parsed.name, routerId: context.routerId }
+            structuredContent: {
+              action: "dry_run",
+              transport: "ftp",
+              name: parsed.name,
+              routerId: context.routerId
+            }
           };
         }
       }
@@ -5090,15 +5231,28 @@ var uploadFileTool = {
         log20.info({ name: parsed.name }, "File uploaded via SFTP");
         return {
           content: `Uploaded "${parsed.name}" to ${context.routerId} via SFTP.`,
-          structuredContent: { action: "uploaded", transport: "sftp", name: parsed.name, routerId: context.routerId }
+          structuredContent: {
+            action: "uploaded",
+            transport: "sftp",
+            name: parsed.name,
+            routerId: context.routerId
+          }
         };
       } catch (sftpErr) {
-        log20.warn({ err: sftpErr, routerId: context.routerId }, "SFTP upload failed \u2014 falling back to FTP");
+        log20.warn(
+          { err: sftpErr, routerId: context.routerId },
+          "SFTP upload failed \u2014 falling back to FTP"
+        );
         await context.ftpClient.upload(parsed.name, parsed.content);
         log20.info({ name: parsed.name }, "File uploaded via FTP");
         return {
           content: `Uploaded "${parsed.name}" to ${context.routerId}${ftpPlaintextNote}.`,
-          structuredContent: { action: "uploaded", transport: "ftp", name: parsed.name, routerId: context.routerId }
+          structuredContent: {
+            action: "uploaded",
+            transport: "ftp",
+            name: parsed.name,
+            routerId: context.routerId
+          }
         };
       }
     } catch (err) {
@@ -6235,12 +6389,12 @@ var RouterOSRestClient = class {
     const query = buildListQuery(options);
     let raw;
     if (query.method === "POST") {
-      raw = await this.doRequest("POST", `${this.baseUrl}/${path}`, query.body);
+      raw = await this.doRequest("POST", `${this.baseUrl}/${path}/print`, query.body);
     } else {
       const qs = query.queryParams ? "?" + new URLSearchParams(query.queryParams).toString() : "";
       raw = await this.doRequest("GET", `${this.baseUrl}/${path}${qs}`);
     }
-    const rawArray = Array.isArray(raw) ? raw : [raw];
+    const rawArray = Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw];
     const parsed = parseRecords(rawArray);
     if (options?.limit !== void 0 || options?.offset !== void 0) {
       const page = applyPagination(parsed, options?.limit, options?.offset);
@@ -6550,7 +6704,12 @@ var RUNTIME_FIELDS = /* @__PURE__ */ new Set([
   "tx-byte",
   "rx-packet",
   "tx-packet",
-  "uptime"
+  "uptime",
+  // Read-only fields on set-menu singletons. Harmless in a normal diff, but a
+  // singleton is restored by writing the whole record back through /set, and
+  // RouterOS rejects the request outright if it carries a read-only parameter.
+  "cache-used",
+  "dynamic-servers"
 ]);
 var ORDER_SENSITIVE_PATHS = /* @__PURE__ */ new Set([
   "ip/firewall/filter",
@@ -6586,16 +6745,16 @@ var SEMANTIC_KEYS = {
   "system/scheduler": ["name"],
   "system/script": ["name"],
   "system/package": ["name"],
-  "container": ["name"],
-  "certificate": ["name"],
-  "file": ["name"],
+  container: ["name"],
+  certificate: ["name"],
+  file: ["name"],
   "interface/vrrp": ["name"],
   "ip/dhcp-server": ["name"],
   "ip/ipsec/peer": ["name"],
   "ip/pool": ["name"],
   "queue/simple": ["name"],
   "tool/netwatch": ["host"],
-  "user": ["name"]
+  user: ["name"]
 };
 function normalizeValue(v) {
   if (v === true || v === "true" || v === "yes") return "true";
@@ -6641,6 +6800,24 @@ function computeRestorePlan(path, beforeRaw, currentRaw) {
       `Restored entries for ${path} are re-created at the end of the list \u2014 rule ORDER is not restored. Review ordering manually after rollback.`
     );
   }
+  if (isSingleton(before, current)) {
+    const beforeRecord = before[0];
+    if (beforeRecord === void 0) {
+      warnings.push(
+        `Snapshot for ${path} holds no record for this singleton \u2014 its current settings are left untouched, as a set-menu singleton cannot be removed.`
+      );
+      return { path, toCreate: [], toRemove: [], toUpdate: [], warnings };
+    }
+    const currentRecord = current[0];
+    if (currentRecord !== void 0 && recordsAreEqual(beforeRecord, currentRecord)) {
+      return { path, toCreate: [], toRemove: [], toUpdate: [], warnings };
+    }
+    const { ".id": _id, ...data } = beforeRecord;
+    const toSet = Object.fromEntries(
+      Object.entries(data).map(([k, v]) => [k, String(v)])
+    );
+    return { path, toCreate: [], toRemove: [], toUpdate: [], toSet, warnings };
+  }
   const keys = SEMANTIC_KEYS[path];
   const canUseKeys = keys !== void 0 && !hasDuplicateKeys(before, keys) && !hasDuplicateKeys(current, keys);
   if (!canUseKeys) {
@@ -6670,7 +6847,16 @@ function computeRestorePlan(path, beforeRaw, currentRaw) {
   const toRemove = current.filter((r) => !beforeByKey.has(semanticKey(r, keys))).map((r) => r[".id"]);
   return applyUserRestriction(path, { path, toCreate, toRemove, toUpdate, warnings });
 }
+function isSingleton(before, current) {
+  if (before.length > 1 || current.length > 1) return false;
+  if (before.length === 0 && current.length === 0) return false;
+  return [...before, ...current].every((r) => r[".id"] === void 0);
+}
 async function applyRestorePlan(plan, client) {
+  if (plan.toSet !== void 0) {
+    await client.execute(`${plan.path}/set`, plan.toSet);
+    return;
+  }
   for (const id of plan.toRemove) {
     await client.remove(plan.path, id);
   }
@@ -6947,10 +7133,18 @@ function createChangeManagementTools(baseTools2) {
         const snapshotIds = [];
         for (const path of snapshotPathsFor(tool, stepParams)) {
           try {
-            const meta = await takeSnapshot(context.deviceClient, context.routerId, path, snapshotDir);
+            const meta = await takeSnapshot(
+              context.deviceClient,
+              context.routerId,
+              path,
+              snapshotDir
+            );
             snapshotIds.push(meta.id);
           } catch (err) {
-            log24.warn({ err, path, routerId: context.routerId, step: i }, "apply_plan step snapshot failed \u2014 proceeding without snapshot");
+            log24.warn(
+              { err, path, routerId: context.routerId, step: i },
+              "apply_plan step snapshot failed \u2014 proceeding without snapshot"
+            );
           }
         }
         const stepJournalId = recordAttempt({
@@ -6966,7 +7160,12 @@ function createChangeManagementTools(baseTools2) {
         try {
           const runStep = () => tool.handler(stepParams, context);
           const result = context.circuitBreaker ? await context.circuitBreaker.execute(runStep) : await runStep();
-          recordOutcome({ journalPath, journalId: stepJournalId, phase: "success", durationMs: Date.now() - stepStartMs });
+          recordOutcome({
+            journalPath,
+            journalId: stepJournalId,
+            phase: "success",
+            durationMs: Date.now() - stepStartMs
+          });
           results2.push({
             stepIndex: i,
             tool: step.tool,
@@ -6976,7 +7175,13 @@ function createChangeManagementTools(baseTools2) {
           });
         } catch (err) {
           const error = err instanceof MikroMCPError ? err : enrichError(err, { tool: step.tool });
-          recordOutcome({ journalPath, journalId: stepJournalId, phase: "failure", outcome: error.code, durationMs: Date.now() - stepStartMs });
+          recordOutcome({
+            journalPath,
+            journalId: stepJournalId,
+            phase: "failure",
+            outcome: error.code,
+            durationMs: Date.now() - stepStartMs
+          });
           log24.error({ err: error, tool: step.tool, step: i }, "apply_plan step failed");
           return {
             content: `Apply failed at step ${i + 1}/${parsed.steps.length} (${step.tool}): ${error.message}. ${i} step(s) completed before failure.`,
@@ -7058,7 +7263,7 @@ function createChangeManagementTools(baseTools2) {
         restorePlans.push(plan);
       }
       const totalOps = restorePlans.reduce(
-        (sum, p) => sum + p.toCreate.length + p.toRemove.length + p.toUpdate.length,
+        (sum, p) => sum + p.toCreate.length + p.toRemove.length + p.toUpdate.length + (p.toSet ? 1 : 0),
         0
       );
       const warnings = restorePlans.flatMap((p) => p.warnings);
@@ -7068,7 +7273,12 @@ ${warnings.map((w) => `  - ${w}`).join("\n")}` : "";
       if (parsed.dryRun) {
         return {
           content: `Rollback dry run for journal entry "${parsed.journalId}": ${totalOps} operation(s) would be applied across ${restorePlans.length} path(s).${warningSuffix}`,
-          structuredContent: { action: "dry_run", journalId: parsed.journalId, restorePlans, warnings }
+          structuredContent: {
+            action: "dry_run",
+            journalId: parsed.journalId,
+            restorePlans,
+            warnings
+          }
         };
       }
       for (const plan of restorePlans) {
@@ -7076,7 +7286,12 @@ ${warnings.map((w) => `  - ${w}`).join("\n")}` : "";
       }
       return {
         content: `Rolled back journal entry "${parsed.journalId}": ${totalOps} operation(s) applied across ${restorePlans.length} path(s).${warningSuffix}`,
-        structuredContent: { action: "rolled_back", journalId: parsed.journalId, restorePlans, warnings }
+        structuredContent: {
+          action: "rolled_back",
+          journalId: parsed.journalId,
+          restorePlans,
+          warnings
+        }
       };
     }
   };
@@ -7173,7 +7388,14 @@ var listIpsecPoliciesTool = {
           policies,
           allPolicies.length,
           0,
-          (p) => compactFields(p, ["src-address", "dst-address", "protocol", "action", "level", "disabled"])
+          (p) => compactFields(p, [
+            "src-address",
+            "dst-address",
+            "protocol",
+            "action",
+            "level",
+            "disabled"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -7221,9 +7443,7 @@ var manageIpsecPeerTool = {
         limit: void 0,
         offset: void 0
       });
-      const existing = allPeers.find(
-        (p) => p.name === parsed.name
-      );
+      const existing = allPeers.find((p) => p.name === parsed.name);
       if (parsed.action === "add") {
         if (existing) {
           if (existing.address === parsed.address) {
@@ -7382,9 +7602,8 @@ var manageIpsecPolicyTool = {
         limit: void 0,
         offset: void 0
       });
-      const tunnelStr = String(parsed.tunnel);
       const existing = all.find(
-        (p) => p["src-address"] === parsed.srcAddress && p["dst-address"] === parsed.dstAddress && p.tunnel === tunnelStr
+        (p) => p["src-address"] === parsed.srcAddress && p["dst-address"] === parsed.dstAddress && isTrue(p.tunnel) === parsed.tunnel
       );
       if (parsed.action === "add") {
         if (existing) {
@@ -7420,7 +7639,7 @@ var manageIpsecPolicyTool = {
         const body = {
           "src-address": parsed.srcAddress,
           "dst-address": parsed.dstAddress,
-          tunnel: tunnelStr,
+          tunnel: String(parsed.tunnel),
           action: parsed.ipsecAction,
           level: parsed.level
         };
@@ -7623,7 +7842,7 @@ var manageCertificateTool = {
         };
       }
       if (parsed.action === "trust") {
-        if (cert.trusted === "yes") {
+        if (isTrue(cert.trusted)) {
           return {
             content: `Certificate "${parsed.name}" is already trusted. No changes made.`,
             structuredContent: { action: "already_trusted", name: parsed.name }
@@ -7646,7 +7865,7 @@ var manageCertificateTool = {
           structuredContent: { action: "trusted", name: parsed.name }
         };
       }
-      if (cert.trusted === "no") {
+      if (cert.trusted !== void 0 && !isTrue(cert.trusted)) {
         return {
           content: `Certificate "${parsed.name}" is already untrusted. No changes made.`,
           structuredContent: { action: "already_untrusted", name: parsed.name }
@@ -7792,14 +8011,16 @@ var manageUserTool = {
           limit: void 0,
           offset: void 0
         });
-        const existing2 = allUsers2.find(
-          (u) => u.name === parsed.name
-        );
+        const existing2 = allUsers2.find((u) => u.name === parsed.name);
         if (existing2) {
           if (existing2.group === parsed.group) {
             return {
               content: `User "${parsed.name}" already exists in group "${parsed.group}". No changes made.`,
-              structuredContent: { action: "already_exists", name: parsed.name, group: existing2.group }
+              structuredContent: {
+                action: "already_exists",
+                name: parsed.name,
+                group: existing2.group
+              }
             };
           }
           throw new MikroMCPError({
@@ -7839,7 +8060,12 @@ var manageUserTool = {
         log27.info({ name: parsed.name, id: created[".id"] }, "User added");
         return {
           content: `Added user "${parsed.name}" in group "${parsed.group}".`,
-          structuredContent: { action: "created", routerId: context.routerId, name: parsed.name, group: parsed.group }
+          structuredContent: {
+            action: "created",
+            routerId: context.routerId,
+            name: parsed.name,
+            group: parsed.group
+          }
         };
       }
       if (parsed.action === "set-password") {
@@ -7859,9 +8085,7 @@ var manageUserTool = {
           limit: void 0,
           offset: void 0
         });
-        const existing2 = allUsers2.find(
-          (u) => u.name === parsed.name
-        );
+        const existing2 = allUsers2.find((u) => u.name === parsed.name);
         if (!existing2) {
           throw new MikroMCPError({
             category: "NOT_FOUND" /* NOT_FOUND */,
@@ -7890,16 +8114,18 @@ var manageUserTool = {
         log27.info({ name: parsed.name }, "User password updated");
         return {
           content: `Password updated for user "${parsed.name}".`,
-          structuredContent: { action: "password_set", routerId: context.routerId, name: parsed.name }
+          structuredContent: {
+            action: "password_set",
+            routerId: context.routerId,
+            name: parsed.name
+          }
         };
       }
       const allUsers = await context.routerClient.get("user", {
         limit: void 0,
         offset: void 0
       });
-      const existing = allUsers.find(
-        (u) => u.name === parsed.name
-      );
+      const existing = allUsers.find((u) => u.name === parsed.name);
       if (parsed.action === "remove") {
         if (!existing) {
           return {
@@ -8053,7 +8279,11 @@ var manageUserGroupTool = {
           if (parsed.policy === void 0 || existing2.policy === parsed.policy) {
             return {
               content: `User group "${parsed.name}" already exists. No changes made.`,
-              structuredContent: { action: "already_exists", name: parsed.name, policy: existing2.policy }
+              structuredContent: {
+                action: "already_exists",
+                name: parsed.name,
+                policy: existing2.policy
+              }
             };
           }
           throw new MikroMCPError({
@@ -8270,9 +8500,7 @@ var manageDhcpServerTool = {
         limit: void 0,
         offset: void 0
       });
-      const existing = allServers.find(
-        (s) => s.name === parsed.name
-      );
+      const existing = allServers.find((s) => s.name === parsed.name);
       if (parsed.action === "add") {
         if (!parsed.interface) {
           throw new MikroMCPError({
@@ -8499,7 +8727,10 @@ var manageIpPoolTool = {
   snapshotPaths: ["ip/pool"],
   async handler(params, context) {
     const parsed = manageIpPoolInputSchema.parse(params);
-    log30.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP pool");
+    log30.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing IP pool"
+    );
     try {
       const allPools = await context.routerClient.get("ip/pool", {
         limit: void 0,
@@ -8567,7 +8798,10 @@ var manageIpPoolTool = {
       if (parsed.dryRun) {
         return {
           content: `Dry run: Would remove IP pool "${parsed.name}".`,
-          structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
         };
       }
       await context.routerClient.remove("ip/pool", existing[".id"]);
@@ -8911,7 +9145,7 @@ var manageVrrpInstanceTool = {
           });
         }
         if (existing) {
-          if (existing.interface === parsed.interface && existing.vrid === String(parsed.vrid)) {
+          if (existing.interface === parsed.interface && sameValue(existing.vrid, parsed.vrid)) {
             return {
               content: `VRRP instance "${parsed.name}" already exists with the same interface and VRID. No changes made.`,
               structuredContent: { action: "already_exists", instance: existing }
@@ -9360,7 +9594,14 @@ var listNeighborsTool = {
           neighbors,
           allNeighbors.length,
           0,
-          (n) => compactFields(n, ["interface", "address", "mac-address", "identity", "platform", "board"])
+          (n) => compactFields(n, [
+            "interface",
+            "address",
+            "mac-address",
+            "identity",
+            "platform",
+            "board"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -9411,7 +9652,14 @@ var listArpEntriesTool = {
           entries,
           allEntries.length,
           0,
-          (e) => compactFields(e, ["address", "mac-address", "interface", "status", "complete", "dynamic"])
+          (e) => compactFields(e, [
+            "address",
+            "mac-address",
+            "interface",
+            "status",
+            "complete",
+            "dynamic"
+          ])
         ),
         structuredContent: {
           routerId: context.routerId,
@@ -9451,12 +9699,15 @@ var manageNtpClientTool = {
     try {
       const results2 = await context.routerClient.get("system/ntp/client");
       const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
-      const id = current[".id"];
       const changes = {};
       const diff = [];
-      if (parsed.enabled !== void 0 && current.enabled !== String(parsed.enabled)) {
+      if (parsed.enabled !== void 0 && isTrue(current.enabled) !== parsed.enabled) {
         changes.enabled = String(parsed.enabled);
-        diff.push({ property: "enabled", before: current.enabled, after: String(parsed.enabled) });
+        diff.push({
+          property: "enabled",
+          before: current.enabled === void 0 ? void 0 : String(current.enabled),
+          after: String(parsed.enabled)
+        });
       }
       if (parsed.mode !== void 0 && current.mode !== parsed.mode) {
         changes.mode = parsed.mode;
@@ -9486,7 +9737,7 @@ var manageNtpClientTool = {
           structuredContent: { action: "dry_run", diff }
         };
       }
-      await context.routerClient.update("system/ntp/client", id, changes);
+      await context.routerClient.execute("system/ntp/client/set", changes);
       log33.info({ routerId: context.routerId }, "NTP client updated");
       return {
         content: `NTP client on ${context.routerId} updated.`,
@@ -9517,7 +9768,9 @@ function sanitizeComment4(comment) {
 var manageVlanInputSchema = z34.object({
   routerId,
   action: z34.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  name: z34.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe("VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"),
+  name: z34.string().regex(/^[a-zA-Z0-9_-]+$/).max(15).describe(
+    "VLAN interface name \u2014 idempotency key (alphanumeric, hyphens, underscores, max 15 chars)"
+  ),
   vlanId: z34.number().int().min(1).max(4094).optional().describe("VLAN ID (1-4094; required for add)"),
   parentInterface: z34.string().optional().describe("Parent interface name (e.g., ether1, bridge1; required for add)"),
   mtu: z34.number().int().min(68).max(9e3).default(1500).describe("MTU size (add only)"),
@@ -9540,13 +9793,18 @@ var manageVlanTool = {
   async handler(params, context) {
     const parsed = manageVlanInputSchema.parse(params);
     const comment = sanitizeComment4(parsed.comment);
-    log34.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing VLAN");
+    log34.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing VLAN"
+    );
     try {
       const allVlans = await context.routerClient.get("interface/vlan", {
         limit: void 0,
         offset: void 0
       });
-      const existing = allVlans.find((v) => v.name === parsed.name);
+      const existing = allVlans.find(
+        (v) => sameValue(v.name, parsed.name)
+      );
       if (parsed.action === "add") {
         if (parsed.vlanId === void 0) {
           throw new MikroMCPError({
@@ -9563,11 +9821,14 @@ var manageVlanTool = {
             code: "VLAN_PARENT_REQUIRED",
             message: "parentInterface is required when adding a VLAN.",
             details: { name: parsed.name },
-            recoverability: { retryable: false, suggestedAction: "Provide the parent interface name." }
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the parent interface name."
+            }
           });
         }
         if (existing) {
-          if (existing["vlan-id"] === String(parsed.vlanId) && existing.interface === parsed.parentInterface) {
+          if (sameValue(existing["vlan-id"], parsed.vlanId) && existing.interface === parsed.parentInterface) {
             log34.info({ name: parsed.name }, "VLAN already exists with matching config");
             return {
               content: `VLAN "${parsed.name}" already exists with VLAN ID ${parsed.vlanId} on ${parsed.parentInterface}. No changes made.`,
@@ -9628,7 +9889,10 @@ var manageVlanTool = {
         if (parsed.dryRun) {
           return {
             content: `Dry run: Would remove VLAN "${parsed.name}".`,
-            structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "name", before: parsed.name, after: null }]
+            }
           };
         }
         await context.routerClient.remove("interface/vlan", existing[".id"]);
@@ -9656,12 +9920,20 @@ var manageVlanTool = {
           content: `Dry run: Would ${parsed.action} VLAN "${parsed.name}".`,
           structuredContent: {
             action: "dry_run",
-            diff: [{ property: "disabled", before: existing.disabled, after: parsed.action === "disable" ? "true" : "false" }]
+            diff: [
+              {
+                property: "disabled",
+                before: existing.disabled,
+                after: parsed.action === "disable" ? "true" : "false"
+              }
+            ]
           }
         };
       }
       const disabledValue = parsed.action === "disable" ? "true" : "false";
-      await context.routerClient.update("interface/vlan", existing[".id"], { disabled: disabledValue });
+      await context.routerClient.update("interface/vlan", existing[".id"], {
+        disabled: disabledValue
+      });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
       log34.info({ name: parsed.name, action: resultAction }, "VLAN updated");
       return {
@@ -9759,7 +10031,10 @@ var manageDhcpClientTool = {
   snapshotPaths: ["ip/dhcp-client"],
   async handler(params, context) {
     const parsed = manageDhcpClientInputSchema.parse(params);
-    log35.info({ routerId: context.routerId, action: parsed.action, interface: parsed.interface }, "Managing DHCP client");
+    log35.info(
+      { routerId: context.routerId, action: parsed.action, interface: parsed.interface },
+      "Managing DHCP client"
+    );
     try {
       const allClients = await context.routerClient.get("ip/dhcp-client", {
         limit: void 0,
@@ -9780,7 +10055,11 @@ var manageDhcpClientTool = {
             { property: "interface", before: null, after: parsed.interface },
             { property: "use-peer-dns", before: null, after: parsed.usePeerDns ? "yes" : "no" },
             { property: "use-peer-ntp", before: null, after: parsed.usePeerNtp ? "yes" : "no" },
-            { property: "add-default-route", before: null, after: parsed.addDefaultRoute ? "yes" : "no" }
+            {
+              property: "add-default-route",
+              before: null,
+              after: parsed.addDefaultRoute ? "yes" : "no"
+            }
           ];
           return {
             content: `Dry run: Would add DHCP client on "${parsed.interface}".`,
@@ -9821,7 +10100,11 @@ var manageDhcpClientTool = {
         log35.info({ interface: parsed.interface }, "DHCP client removed");
         return {
           content: `Removed DHCP client on "${parsed.interface}".`,
-          structuredContent: { action: "removed", interface: parsed.interface, id: existing[".id"] }
+          structuredContent: {
+            action: "removed",
+            interface: parsed.interface,
+            id: existing[".id"]
+          }
         };
       }
       if (!existing) {
@@ -9853,12 +10136,18 @@ var manageDhcpClientTool = {
         };
       }
       const disabledValue = parsed.action === "disable" ? "true" : "false";
-      await context.routerClient.update("ip/dhcp-client", existing[".id"], { disabled: disabledValue });
+      await context.routerClient.update("ip/dhcp-client", existing[".id"], {
+        disabled: disabledValue
+      });
       const resultAction = parsed.action === "disable" ? "disabled" : "enabled";
       log35.info({ interface: parsed.interface, action: resultAction }, "DHCP client updated");
       return {
         content: `DHCP client on "${parsed.interface}" ${resultAction}.`,
-        structuredContent: { action: resultAction, interface: parsed.interface, id: existing[".id"] }
+        structuredContent: {
+          action: resultAction,
+          interface: parsed.interface,
+          id: existing[".id"]
+        }
       };
     } catch (err) {
       throw toolError(err, context, "manage_dhcp_client");
@@ -9870,7 +10159,16 @@ var dhcpClientTools = [listDhcpClientsTool, manageDhcpClientTool];
 // src/domain/tools/ip-service-tools.ts
 import { z as z36 } from "zod";
 var log36 = createLogger("ip-service-tools");
-var SERVICE_NAMES = ["api", "api-ssl", "ssh", "telnet", "www", "www-ssl", "winbox", "ftp"];
+var SERVICE_NAMES = [
+  "api",
+  "api-ssl",
+  "ssh",
+  "telnet",
+  "www",
+  "www-ssl",
+  "winbox",
+  "ftp"
+];
 var listIpServicesInputSchema = z36.object({
   routerId,
   name: z36.enum(SERVICE_NAMES).optional().describe("Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)"),
@@ -9946,13 +10244,18 @@ var manageIpServiceTool = {
   },
   async handler(params, context) {
     const parsed = manageIpServiceInputSchema.parse(params);
-    log36.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing IP service");
+    log36.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing IP service"
+    );
     try {
       const allServices = await context.routerClient.get("ip/service", {
         limit: void 0,
         offset: void 0
       });
-      const existing = allServices.find((s) => s.name === parsed.name);
+      const existing = allServices.find(
+        (s) => s.name === parsed.name
+      );
       if (!existing) {
         throw new MikroMCPError({
           category: "NOT_FOUND" /* NOT_FOUND */,
@@ -10097,13 +10400,18 @@ var managePppoeClientTool = {
   snapshotPaths: [PPPOE_PATH],
   async handler(params, context) {
     const parsed = managePppoeClientInputSchema.parse(params);
-    log37.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPPoE client");
+    log37.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing PPPoE client"
+    );
     try {
       const allClients = await context.routerClient.get(PPPOE_PATH, {
         limit: void 0,
         offset: void 0
       });
-      const existing = allClients.find((c) => c.name === parsed.name);
+      const existing = allClients.find(
+        (c) => sameValue(c.name, parsed.name)
+      );
       if (parsed.action === "add") {
         if (!parsed.interface) {
           throw new MikroMCPError({
@@ -10163,10 +10471,18 @@ var managePppoeClientTool = {
           diff.push({ property: "service-name", before: null, after: parsed.serviceName });
         }
         if (parsed.addDefaultRoute !== void 0) {
-          diff.push({ property: "add-default-route", before: null, after: parsed.addDefaultRoute ? "yes" : "no" });
+          diff.push({
+            property: "add-default-route",
+            before: null,
+            after: parsed.addDefaultRoute ? "yes" : "no"
+          });
         }
         if (parsed.dialOnDemand !== void 0) {
-          diff.push({ property: "dial-on-demand", before: null, after: parsed.dialOnDemand ? "yes" : "no" });
+          diff.push({
+            property: "dial-on-demand",
+            before: null,
+            after: parsed.dialOnDemand ? "yes" : "no"
+          });
         }
         if (parsed.dryRun) {
           return {
@@ -10181,8 +10497,10 @@ var managePppoeClientTool = {
         };
         if (parsed.password !== void 0) body.password = parsed.password;
         if (parsed.serviceName !== void 0) body["service-name"] = parsed.serviceName;
-        if (parsed.addDefaultRoute !== void 0) body["add-default-route"] = parsed.addDefaultRoute ? "yes" : "no";
-        if (parsed.dialOnDemand !== void 0) body["dial-on-demand"] = parsed.dialOnDemand ? "yes" : "no";
+        if (parsed.addDefaultRoute !== void 0)
+          body["add-default-route"] = parsed.addDefaultRoute ? "yes" : "no";
+        if (parsed.dialOnDemand !== void 0)
+          body["dial-on-demand"] = parsed.dialOnDemand ? "yes" : "no";
         const created = await context.routerClient.create(PPPOE_PATH, body);
         log37.info({ name: parsed.name, id: created[".id"] }, "PPPoE client created");
         return {
@@ -10216,21 +10534,29 @@ var managePppoeClientTool = {
         }
         if (parsed.serviceName !== void 0 && existing["service-name"] !== parsed.serviceName) {
           updates["service-name"] = parsed.serviceName;
-          diff.push({ property: "service-name", before: existing["service-name"] ?? null, after: parsed.serviceName });
+          diff.push({
+            property: "service-name",
+            before: existing["service-name"] ?? null,
+            after: parsed.serviceName
+          });
         }
-        if (parsed.addDefaultRoute !== void 0) {
+        if (parsed.addDefaultRoute !== void 0 && isTrue(existing["add-default-route"]) !== parsed.addDefaultRoute) {
           const desired = parsed.addDefaultRoute ? "yes" : "no";
-          if (existing["add-default-route"] !== desired) {
-            updates["add-default-route"] = desired;
-            diff.push({ property: "add-default-route", before: existing["add-default-route"] ?? null, after: desired });
-          }
+          updates["add-default-route"] = desired;
+          diff.push({
+            property: "add-default-route",
+            before: existing["add-default-route"] === void 0 ? null : String(existing["add-default-route"]),
+            after: desired
+          });
         }
-        if (parsed.dialOnDemand !== void 0) {
+        if (parsed.dialOnDemand !== void 0 && isTrue(existing["dial-on-demand"]) !== parsed.dialOnDemand) {
           const desired = parsed.dialOnDemand ? "yes" : "no";
-          if (existing["dial-on-demand"] !== desired) {
-            updates["dial-on-demand"] = desired;
-            diff.push({ property: "dial-on-demand", before: existing["dial-on-demand"] ?? null, after: desired });
-          }
+          updates["dial-on-demand"] = desired;
+          diff.push({
+            property: "dial-on-demand",
+            before: existing["dial-on-demand"] === void 0 ? null : String(existing["dial-on-demand"]),
+            after: desired
+          });
         }
         if (parsed.password !== void 0) {
           updates.password = parsed.password;
@@ -10363,13 +10689,18 @@ var manageOvpnClientTool = {
   snapshotPaths: [OVPN_CLIENT_PATH],
   async handler(params, context) {
     const parsed = manageOvpnClientInputSchema.parse(params);
-    log38.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing OpenVPN client");
+    log38.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing OpenVPN client"
+    );
     try {
       const allClients = await context.routerClient.get(OVPN_CLIENT_PATH, {
         limit: void 0,
         offset: void 0
       });
-      const existing = allClients.find((c) => c.name === parsed.name);
+      const existing = allClients.find(
+        (c) => sameValue(c.name, parsed.name)
+      );
       if (parsed.action === "add") {
         if (!parsed.connectTo) {
           throw new MikroMCPError({
@@ -10452,11 +10783,19 @@ var manageOvpnClientTool = {
         const diff = [];
         if (parsed.connectTo !== void 0 && existing["connect-to"] !== parsed.connectTo) {
           updates["connect-to"] = parsed.connectTo;
-          diff.push({ property: "connect-to", before: existing["connect-to"] ?? null, after: parsed.connectTo });
+          diff.push({
+            property: "connect-to",
+            before: existing["connect-to"] ?? null,
+            after: parsed.connectTo
+          });
         }
-        if (parsed.port !== void 0 && existing.port !== String(parsed.port)) {
+        if (parsed.port !== void 0 && !sameValue(existing.port, parsed.port)) {
           updates.port = String(parsed.port);
-          diff.push({ property: "port", before: existing.port ?? null, after: String(parsed.port) });
+          diff.push({
+            property: "port",
+            before: existing.port === void 0 ? null : String(existing.port),
+            after: String(parsed.port)
+          });
         }
         if (parsed.mode !== void 0 && existing.mode !== parsed.mode) {
           updates.mode = parsed.mode;
@@ -10464,11 +10803,19 @@ var manageOvpnClientTool = {
         }
         if (parsed.protocol !== void 0 && existing.protocol !== parsed.protocol) {
           updates.protocol = parsed.protocol;
-          diff.push({ property: "protocol", before: existing.protocol ?? null, after: parsed.protocol });
+          diff.push({
+            property: "protocol",
+            before: existing.protocol ?? null,
+            after: parsed.protocol
+          });
         }
         if (parsed.certificate !== void 0 && existing.certificate !== parsed.certificate) {
           updates.certificate = parsed.certificate;
-          diff.push({ property: "certificate", before: existing.certificate ?? null, after: parsed.certificate });
+          diff.push({
+            property: "certificate",
+            before: existing.certificate ?? null,
+            after: parsed.certificate
+          });
         }
         if (parsed.user !== void 0 && existing.user !== parsed.user) {
           updates.user = parsed.user;
@@ -10540,8 +10887,33 @@ function fetchOvpnServer(allRecords, routerId2) {
       }
     });
   }
+  if (allRecords.length > 1) {
+    const names = allRecords.map((r) => r.name ?? "?").join(", ");
+    throw new MikroMCPError({
+      category: "CONFLICT" /* CONFLICT */,
+      code: "OVPN_SERVER_AMBIGUOUS",
+      message: `Multiple OpenVPN server instances exist (${names}); this tool cannot pick one safely.`,
+      details: { routerId: routerId2, instances: names },
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Remove the extra instances so exactly one remains.",
+        alternativeTools: []
+      }
+    });
+  }
   return allRecords[0];
 }
+async function writeOvpnServer(context, server, changes) {
+  const serverId = server[".id"];
+  if (serverId !== void 0) {
+    await context.routerClient.update(OVPN_SERVER_PATH, serverId, changes);
+  } else {
+    await context.routerClient.execute(`${OVPN_SERVER_PATH}/set`, changes);
+  }
+}
+function ovpnServerEnabled(server) {
+  return server.enabled !== void 0 ? isTrue(server.enabled) : !isTrue(server.disabled);
+}
 var getOvpnServerTool = {
   name: "get_ovpn_server",
   title: "Get OpenVPN Server",
@@ -10563,7 +10935,7 @@ var getOvpnServerTool = {
       });
       const server = fetchOvpnServer(records, context.routerId);
       return {
-        content: `OpenVPN server on ${context.routerId}: enabled=${server.enabled}, port=${server.port}, protocol=${server.protocol}`,
+        content: `OpenVPN server on ${context.routerId}: enabled=${ovpnServerEnabled(server)}, port=${server.port}, protocol=${server.protocol}`,
         structuredContent: { routerId: context.routerId, server }
       };
     } catch (err) {
@@ -10578,7 +10950,15 @@ var manageOvpnServerInputSchema = z38.object({
   mode: z38.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
   protocol: z38.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
   certificate: z38.string().optional().describe("Server certificate name (set action only)"),
-  cipher: z38.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
+  cipher: z38.enum([
+    "blowfish128",
+    "aes128-cbc",
+    "aes192-cbc",
+    "aes256-cbc",
+    "aes128-gcm",
+    "aes256-gcm",
+    "none"
+  ]).optional().describe("Encryption cipher (set action only)"),
   auth: z38.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
   dryRun
 }).strict();
@@ -10603,32 +10983,42 @@ var manageOvpnServerTool = {
         offset: void 0
       });
       const server = fetchOvpnServer(records, context.routerId);
-      const serverId = server[".id"];
       if (parsed.action === "enable" || parsed.action === "disable") {
         const desiredEnabled = parsed.action === "enable";
-        const currentEnabled = server.enabled === "yes";
+        const legacyDialect = server.enabled !== void 0;
+        const currentEnabled = ovpnServerEnabled(server);
         if (desiredEnabled === currentEnabled) {
           return {
             content: `OpenVPN server on ${context.routerId} is already ${parsed.action}d. No changes made.`,
             structuredContent: { action: "no_change", server }
           };
         }
+        const change = legacyDialect ? {
+          property: "enabled",
+          before: String(server.enabled),
+          after: desiredEnabled ? "yes" : "no"
+        } : {
+          property: "disabled",
+          before: server.disabled === void 0 ? null : String(server.disabled),
+          after: desiredEnabled ? "no" : "yes"
+        };
         if (parsed.dryRun) {
           return {
             content: `Dry run: Would ${parsed.action} OpenVPN server on ${context.routerId}.`,
             structuredContent: {
               action: "dry_run",
-              diff: [{ property: "enabled", before: server.enabled, after: desiredEnabled ? "yes" : "no" }]
+              diff: [change]
             }
           };
         }
-        await context.routerClient.update(OVPN_SERVER_PATH, serverId, {
-          enabled: desiredEnabled ? "yes" : "no"
-        });
+        await writeOvpnServer(context, server, { [change.property]: change.after });
         log38.info({ routerId: context.routerId, action: parsed.action }, "OpenVPN server updated");
         return {
           content: `OpenVPN server on ${context.routerId} ${parsed.action}d.`,
-          structuredContent: { action: parsed.action === "enable" ? "enabled" : "disabled", server }
+          structuredContent: {
+            action: parsed.action === "enable" ? "enabled" : "disabled",
+            server
+          }
         };
       }
       const hasFields = parsed.port !== void 0 || parsed.mode !== void 0 || parsed.protocol !== void 0 || parsed.certificate !== void 0 || parsed.cipher !== void 0 || parsed.auth !== void 0;
@@ -10647,9 +11037,13 @@ var manageOvpnServerTool = {
       }
       const updates = {};
       const diff = [];
-      if (parsed.port !== void 0 && server.port !== String(parsed.port)) {
+      if (parsed.port !== void 0 && !sameValue(server.port, parsed.port)) {
         updates.port = String(parsed.port);
-        diff.push({ property: "port", before: server.port ?? null, after: String(parsed.port) });
+        diff.push({
+          property: "port",
+          before: server.port === void 0 ? null : String(server.port),
+          after: String(parsed.port)
+        });
       }
       if (parsed.mode !== void 0 && server.mode !== parsed.mode) {
         updates.mode = parsed.mode;
@@ -10657,11 +11051,19 @@ var manageOvpnServerTool = {
       }
       if (parsed.protocol !== void 0 && server.protocol !== parsed.protocol) {
         updates.protocol = parsed.protocol;
-        diff.push({ property: "protocol", before: server.protocol ?? null, after: parsed.protocol });
+        diff.push({
+          property: "protocol",
+          before: server.protocol ?? null,
+          after: parsed.protocol
+        });
       }
       if (parsed.certificate !== void 0 && server.certificate !== parsed.certificate) {
         updates.certificate = parsed.certificate;
-        diff.push({ property: "certificate", before: server.certificate ?? null, after: parsed.certificate });
+        diff.push({
+          property: "certificate",
+          before: server.certificate ?? null,
+          after: parsed.certificate
+        });
       }
       if (parsed.cipher !== void 0 && server.cipher !== parsed.cipher) {
         updates.cipher = parsed.cipher;
@@ -10683,7 +11085,7 @@ var manageOvpnServerTool = {
           structuredContent: { action: "dry_run", diff }
         };
       }
-      await context.routerClient.update(OVPN_SERVER_PATH, serverId, updates);
+      await writeOvpnServer(context, server, updates);
       log38.info({ routerId: context.routerId }, "OpenVPN server configuration updated");
       return {
         content: `Updated OpenVPN server configuration on ${context.routerId}.`,
@@ -10714,12 +11116,20 @@ var listPppProfilesTool = {
   title: "List PPP Profiles",
   description: "List PPP profiles including the built-in default and default-encryption profiles.",
   inputSchema: listPppProfilesInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = listPppProfilesInputSchema.parse(params);
     try {
       log39.info({ routerId: context.routerId }, "Listing PPP profiles");
-      const all = await context.routerClient.get("ppp/profile", { limit: void 0, offset: void 0 });
+      const all = await context.routerClient.get("ppp/profile", {
+        limit: void 0,
+        offset: void 0
+      });
       const filtered = parsed.name ? all.filter((p) => p.name === parsed.name) : all;
       const profiles = filtered.slice(0, parsed.limit);
       return {
@@ -10731,7 +11141,12 @@ var listPppProfilesTool = {
           0,
           (p) => compactFields(p, ["name", "local-address", "remote-address", "dns-server", "rate-limit"])
         ),
-        structuredContent: { routerId: context.routerId, profiles, total: all.length, returned: profiles.length }
+        structuredContent: {
+          routerId: context.routerId,
+          profiles,
+          total: all.length,
+          returned: profiles.length
+        }
       };
     } catch (err) {
       throw toolError(err, context, "list_ppp_profiles");
@@ -10755,13 +11170,24 @@ var managePppProfileTool = {
   title: "Manage PPP Profile",
   description: "Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed \u2014 RouterOS blocks this and the error is surfaced.",
   inputSchema: managePppProfileInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   snapshotPaths: ["ppp/profile"],
   async handler(params, context) {
     const parsed = managePppProfileInputSchema.parse(params);
-    log39.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPP profile");
+    log39.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing PPP profile"
+    );
     try {
-      const all = await context.routerClient.get("ppp/profile", { limit: void 0, offset: void 0 });
+      const all = await context.routerClient.get("ppp/profile", {
+        limit: void 0,
+        offset: void 0
+      });
       const existing = all.find((p) => p.name === parsed.name);
       if (parsed.action === "add") {
         if (existing) {
@@ -10774,12 +11200,18 @@ var managePppProfileTool = {
           const diff = [
             { property: "name", before: null, after: parsed.name }
           ];
-          if (parsed.localAddress) diff.push({ property: "local-address", before: null, after: parsed.localAddress });
-          if (parsed.remoteAddress) diff.push({ property: "remote-address", before: null, after: parsed.remoteAddress });
-          if (parsed.dnsServer) diff.push({ property: "dns-server", before: null, after: parsed.dnsServer });
-          if (parsed.rateLimit) diff.push({ property: "rate-limit", before: null, after: parsed.rateLimit });
-          if (parsed.sessionTimeout) diff.push({ property: "session-timeout", before: null, after: parsed.sessionTimeout });
-          if (parsed.comment) diff.push({ property: "comment", before: null, after: parsed.comment });
+          if (parsed.localAddress)
+            diff.push({ property: "local-address", before: null, after: parsed.localAddress });
+          if (parsed.remoteAddress)
+            diff.push({ property: "remote-address", before: null, after: parsed.remoteAddress });
+          if (parsed.dnsServer)
+            diff.push({ property: "dns-server", before: null, after: parsed.dnsServer });
+          if (parsed.rateLimit)
+            diff.push({ property: "rate-limit", before: null, after: parsed.rateLimit });
+          if (parsed.sessionTimeout)
+            diff.push({ property: "session-timeout", before: null, after: parsed.sessionTimeout });
+          if (parsed.comment)
+            diff.push({ property: "comment", before: null, after: parsed.comment });
           return {
             content: `Dry run: Would create PPP profile "${parsed.name}".`,
             structuredContent: { action: "dry_run", diff }
@@ -10806,34 +11238,62 @@ var managePppProfileTool = {
             code: "PPP_PROFILE_NOT_FOUND",
             message: `PPP profile "${parsed.name}" not found.`,
             details: { name: parsed.name },
-            recoverability: { retryable: false, suggestedAction: "Verify with list_ppp_profiles.", alternativeTools: ["list_ppp_profiles"] }
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify with list_ppp_profiles.",
+              alternativeTools: ["list_ppp_profiles"]
+            }
           });
         }
         const changes = {};
         const diff = [];
         if (parsed.localAddress !== void 0 && existing["local-address"] !== parsed.localAddress) {
           changes["local-address"] = parsed.localAddress;
-          diff.push({ property: "local-address", before: existing["local-address"] ?? null, after: parsed.localAddress });
+          diff.push({
+            property: "local-address",
+            before: existing["local-address"] ?? null,
+            after: parsed.localAddress
+          });
         }
         if (parsed.remoteAddress !== void 0 && existing["remote-address"] !== parsed.remoteAddress) {
           changes["remote-address"] = parsed.remoteAddress;
-          diff.push({ property: "remote-address", before: existing["remote-address"] ?? null, after: parsed.remoteAddress });
+          diff.push({
+            property: "remote-address",
+            before: existing["remote-address"] ?? null,
+            after: parsed.remoteAddress
+          });
         }
         if (parsed.dnsServer !== void 0 && existing["dns-server"] !== parsed.dnsServer) {
           changes["dns-server"] = parsed.dnsServer;
-          diff.push({ property: "dns-server", before: existing["dns-server"] ?? null, after: parsed.dnsServer });
+          diff.push({
+            property: "dns-server",
+            before: existing["dns-server"] ?? null,
+            after: parsed.dnsServer
+          });
         }
         if (parsed.rateLimit !== void 0 && existing["rate-limit"] !== parsed.rateLimit) {
           changes["rate-limit"] = parsed.rateLimit;
-          diff.push({ property: "rate-limit", before: existing["rate-limit"] ?? null, after: parsed.rateLimit });
+          diff.push({
+            property: "rate-limit",
+            before: existing["rate-limit"] ?? null,
+            after: parsed.rateLimit
+          });
         }
         if (parsed.sessionTimeout !== void 0 && existing["session-timeout"] !== parsed.sessionTimeout) {
           changes["session-timeout"] = parsed.sessionTimeout;
-          diff.push({ property: "session-timeout", before: existing["session-timeout"] ?? null, after: parsed.sessionTimeout });
+          diff.push({
+            property: "session-timeout",
+            before: existing["session-timeout"] ?? null,
+            after: parsed.sessionTimeout
+          });
         }
         if (parsed.comment !== void 0 && existing.comment !== parsed.comment) {
           changes.comment = parsed.comment;
-          diff.push({ property: "comment", before: existing.comment ?? null, after: parsed.comment });
+          diff.push({
+            property: "comment",
+            before: existing.comment ?? null,
+            after: parsed.comment
+          });
         }
         if (Object.keys(changes).length === 0) {
           return {
@@ -10863,7 +11323,10 @@ var managePppProfileTool = {
       if (parsed.dryRun) {
         return {
           content: `Dry run: Would remove PPP profile "${parsed.name}".`,
-          structuredContent: { action: "dry_run", diff: [{ property: "name", before: parsed.name, after: null }] }
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
         };
       }
       await context.routerClient.remove("ppp/profile", existing[".id"]);
@@ -11032,7 +11495,9 @@ var createBackupTool = {
 var exportConfigInputSchema = z41.object({
   routerId,
   compact: z41.boolean().default(false).describe("Export only non-default settings (compact format)"),
-  file: z41.string().optional().describe("Save the export to a file on the router (without extension); omit to return inline")
+  file: z41.string().optional().describe(
+    "Save the export to a file on the router (without extension); omit to return inline"
+  )
 }).strict();
 var exportConfigTool = {
   name: "export_config",
@@ -11204,7 +11669,10 @@ var manageLogRuleTool = {
           };
         }
         const created = await context.routerClient.create(LOG_RULES_PATH, body);
-        log42.info({ topics: parsed.topics, logAction: parsed.logAction, id: created[".id"] }, "Log rule added");
+        log42.info(
+          { topics: parsed.topics, logAction: parsed.logAction, id: created[".id"] },
+          "Log rule added"
+        );
         return {
           content: `Added log rule topics="${parsed.topics}" action="${parsed.logAction}".`,
           structuredContent: {
@@ -11260,7 +11728,13 @@ var manageLogRuleTool = {
             structuredContent: {
               action: "dry_run",
               id,
-              diff: [{ property: "disabled", before: existing.disabled ?? "false", after: String(wantDisabled) }]
+              diff: [
+                {
+                  property: "disabled",
+                  before: existing.disabled ?? "false",
+                  after: String(wantDisabled)
+                }
+              ]
             }
           };
         }
@@ -11492,17 +11966,25 @@ var bandwidthTestTool = {
   // Reaches an external host and saturates the link; a silent retry would
   // double the load, so opt out of auto-retry.
   retryable: false,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: false, openWorldHint: true },
-  async handler(params, context) {
-    const parsed = bandwidthTestInputSchema.parse(params);
-    log43.info({ routerId: context.routerId, address: parsed.address }, "Running bandwidth test");
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true
+  },
+  async handler(params, context) {
+    const parsed = bandwidthTestInputSchema.parse(params);
+    log43.info({ routerId: context.routerId, address: parsed.address }, "Running bandwidth test");
     try {
-      const result = await context.routerClient.execute("tool/bandwidth-test", {
-        address: parsed.address,
-        protocol: parsed.protocol,
-        direction: parsed.direction,
-        duration: String(parsed.duration)
-      });
+      const result = await context.routerClient.execute(
+        "tool/bandwidth-test",
+        {
+          address: parsed.address,
+          protocol: parsed.protocol,
+          direction: parsed.direction,
+          duration: String(parsed.duration)
+        }
+      );
       const txBps = Number(result["tx-current"] ?? 0);
       const rxBps = Number(result["rx-current"] ?? 0);
       const txMbps = Math.round(txBps / 1e6 * 100) / 100;
@@ -11538,12 +12020,23 @@ var fetchUrlTool = {
   inputSchema: fetchUrlInputSchema,
   // Not read-only: a POST has external side effects and outputFile writes a
   // file on the router. openWorld: reaches arbitrary external hosts.
-  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true
+  },
   async handler(params, context) {
     const parsed = fetchUrlInputSchema.parse(params);
-    log43.info({ routerId: context.routerId, url: parsed.url, method: parsed.method }, "Fetching URL");
+    log43.info(
+      { routerId: context.routerId, url: parsed.url, method: parsed.method },
+      "Fetching URL"
+    );
     try {
-      const body = { url: parsed.url, "http-method": parsed.method.toLowerCase() };
+      const body = {
+        url: parsed.url,
+        "http-method": parsed.method.toLowerCase()
+      };
       if (parsed.httpData) body["http-data"] = parsed.httpData;
       if (parsed.outputFile) {
         body.output = "file";
@@ -11551,13 +12044,21 @@ var fetchUrlTool = {
       } else {
         body.output = "user";
       }
-      const sections = await context.routerClient.execute("tool/fetch", body);
+      const sections = await context.routerClient.execute(
+        "tool/fetch",
+        body
+      );
       const finished = sections.find((s) => s.status === "finished") ?? sections[sections.length - 1];
       const statusCode = finished?.code ?? null;
       if (parsed.outputFile) {
         return {
           content: `Fetched ${parsed.url} \u2192 saved to ${parsed.outputFile} (status ${statusCode})`,
-          structuredContent: { routerId: context.routerId, url: parsed.url, statusCode, outputFile: parsed.outputFile }
+          structuredContent: {
+            routerId: context.routerId,
+            url: parsed.url,
+            statusCode,
+            outputFile: parsed.outputFile
+          }
         };
       }
       let responseBody = finished?.data ?? "";
@@ -11566,7 +12067,12 @@ var fetchUrlTool = {
       }
       return {
         content: `Fetched ${parsed.url}: status=${statusCode} body_length=${responseBody.length}`,
-        structuredContent: { routerId: context.routerId, url: parsed.url, statusCode, body: responseBody }
+        structuredContent: {
+          routerId: context.routerId,
+          url: parsed.url,
+          statusCode,
+          body: responseBody
+        }
       };
     } catch (err) {
       throw toolError(err, context, "fetch_url");
@@ -11585,7 +12091,12 @@ var listConnectionsTool = {
   title: "List Connections",
   description: "List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.",
   inputSchema: listConnectionsInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = listConnectionsInputSchema.parse(params);
     log43.info({ routerId: context.routerId }, "Listing connections");
@@ -11602,7 +12113,11 @@ var listConnectionsTool = {
         limit: void 0,
         offset: void 0
       });
-      const filtered = all.filter((c) => parsed.srcAddress ? (c["src-address"] ?? "").includes(parsed.srcAddress) : true).filter((c) => parsed.dstAddress ? (c["dst-address"] ?? "").includes(parsed.dstAddress) : true).filter((c) => parsed.protocol ? c.protocol === parsed.protocol : true);
+      const filtered = all.filter(
+        (c) => parsed.srcAddress ? (c["src-address"] ?? "").includes(parsed.srcAddress) : true
+      ).filter(
+        (c) => parsed.dstAddress ? (c["dst-address"] ?? "").includes(parsed.dstAddress) : true
+      ).filter((c) => parsed.protocol ? c.protocol === parsed.protocol : true);
       const connections = filtered.slice(0, parsed.limit);
       return {
         content: listContent(
@@ -11619,14 +12134,23 @@ var listConnectionsTool = {
             "connection-mark"
           ])
         ),
-        structuredContent: { routerId: context.routerId, connections, total: all.length, returned: connections.length }
+        structuredContent: {
+          routerId: context.routerId,
+          connections,
+          total: all.length,
+          returned: connections.length
+        }
       };
     } catch (err) {
       throw toolError(err, context, "list_connections");
     }
   }
 };
-var networkTestTools = [bandwidthTestTool, fetchUrlTool, listConnectionsTool];
+var networkTestTools = [
+  bandwidthTestTool,
+  fetchUrlTool,
+  listConnectionsTool
+];
 
 // src/domain/tools/container-config-tools.ts
 import { z as z44 } from "zod";
@@ -11637,7 +12161,12 @@ var getContainerConfigTool = {
   title: "Get Container Config",
   description: "Read global container configuration: registry URL, RAM high-water mark, and veth interface.",
   inputSchema: getContainerConfigInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     getContainerConfigInputSchema.parse(params);
     log44.info({ routerId: context.routerId }, "Getting container config");
@@ -11670,7 +12199,12 @@ var manageContainerConfigTool = {
   title: "Manage Container Config",
   description: "Update global container settings. Idempotent: returns no_change if nothing differs.",
   inputSchema: manageContainerConfigInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   snapshotPaths: ["container/config"],
   async handler(params, context) {
     const parsed = manageContainerConfigInputSchema.parse(params);
@@ -11678,23 +12212,34 @@ var manageContainerConfigTool = {
     try {
       const results2 = await context.routerClient.get("container/config");
       const current = Array.isArray(results2) && results2.length > 0 ? results2[0] : results2;
-      const id = current[".id"];
       const changes = {};
       const diff = [];
       if (parsed.registryUrl !== void 0 && current["registry-url"] !== parsed.registryUrl) {
         changes["registry-url"] = parsed.registryUrl;
-        diff.push({ property: "registry-url", before: current["registry-url"] ?? null, after: parsed.registryUrl });
+        diff.push({
+          property: "registry-url",
+          before: current["registry-url"] ?? null,
+          after: parsed.registryUrl
+        });
       }
       if (parsed.ramHighMb !== void 0) {
         const next = String(parsed.ramHighMb);
-        if (current["ram-high"] !== next) {
+        if (!sameValue(current["ram-high"], next)) {
           changes["ram-high"] = next;
-          diff.push({ property: "ram-high", before: current["ram-high"] ?? null, after: next });
+          diff.push({
+            property: "ram-high",
+            before: current["ram-high"] === void 0 ? null : String(current["ram-high"]),
+            after: next
+          });
         }
       }
       if (parsed.vethInterface !== void 0 && current["veth-interface"] !== parsed.vethInterface) {
         changes["veth-interface"] = parsed.vethInterface;
-        diff.push({ property: "veth-interface", before: current["veth-interface"] ?? null, after: parsed.vethInterface });
+        diff.push({
+          property: "veth-interface",
+          before: current["veth-interface"] ?? null,
+          after: parsed.vethInterface
+        });
       }
       if (Object.keys(changes).length === 0) {
         return {
@@ -11708,7 +12253,7 @@ var manageContainerConfigTool = {
           structuredContent: { action: "dry_run", diff }
         };
       }
-      await context.routerClient.update("container/config", id, changes);
+      await context.routerClient.execute("container/config/set", changes);
       log44.info({ routerId: context.routerId }, "Container config updated");
       return {
         content: `Updated container config on ${context.routerId}.`,
@@ -11729,7 +12274,12 @@ var listContainerEnvsTool = {
   title: "List Container Envs",
   description: "List container environment variable entries, optionally filtered by container name.",
   inputSchema: listContainerEnvsInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = listContainerEnvsInputSchema.parse(params);
     log44.info({ routerId: context.routerId }, "Listing container envs");
@@ -11749,7 +12299,12 @@ var listContainerEnvsTool = {
           0,
           (e) => compactFields(e, ["name", "key", "value"])
         ),
-        structuredContent: { routerId: context.routerId, envs, total: all.length, returned: envs.length }
+        structuredContent: {
+          routerId: context.routerId,
+          envs,
+          total: all.length,
+          returned: envs.length
+        }
       };
     } catch (err) {
       throw toolError(err, context, "list_container_envs");
@@ -11769,7 +12324,12 @@ var manageContainerEnvTool = {
   title: "Manage Container Env",
   description: "Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.",
   inputSchema: manageContainerEnvInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = manageContainerEnvInputSchema.parse(params);
     log44.info(
@@ -11873,7 +12433,12 @@ var listContainerMountsTool = {
   title: "List Container Mounts",
   description: "List container volume mount definitions with source path, destination path, and mount name.",
   inputSchema: listContainerMountsInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = listContainerMountsInputSchema.parse(params);
     log44.info({ routerId: context.routerId }, "Listing container mounts");
@@ -11893,7 +12458,12 @@ var listContainerMountsTool = {
           0,
           (m) => compactFields(m, ["name", "src", "dst"])
         ),
-        structuredContent: { routerId: context.routerId, mounts, total: all.length, returned: mounts.length }
+        structuredContent: {
+          routerId: context.routerId,
+          mounts,
+          total: all.length,
+          returned: mounts.length
+        }
       };
     } catch (err) {
       throw toolError(err, context, "list_container_mounts");
@@ -11913,10 +12483,18 @@ var manageContainerMountTool = {
   title: "Manage Container Mount",
   description: "Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.",
   inputSchema: manageContainerMountInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = manageContainerMountInputSchema.parse(params);
-    log44.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing container mount");
+    log44.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing container mount"
+    );
     try {
       const all = await context.routerClient.get("container/mounts", {
         limit: void 0,
@@ -11951,7 +12529,10 @@ var manageContainerMountTool = {
             category: "VALIDATION" /* VALIDATION */,
             code: "MOUNT_PATHS_REQUIRED",
             message: "src and dst are required for add.",
-            recoverability: { retryable: false, suggestedAction: "Provide src and dst parameters." }
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide src and dst parameters."
+            }
           });
         }
         if (parsed.dryRun) {
@@ -12021,7 +12602,12 @@ var listInterfaceListsTool = {
   title: "List Interface Lists",
   description: "List all interface lists defined on the router.",
   inputSchema: listInterfaceListsInputSchema,
-  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = listInterfaceListsInputSchema.parse(params);
     log45.info({ routerId: context.routerId }, "Listing interface lists");
@@ -12040,7 +12626,12 @@ var listInterfaceListsTool = {
           0,
           (l) => compactFields(l, ["name", "include", "exclude", "comment"])
         ),
-        structuredContent: { routerId: context.routerId, lists, total: all.length, returned: lists.length }
+        structuredContent: {
+          routerId: context.routerId,
+          lists,
+          total: all.length,
+          returned: lists.length
+        }
       };
     } catch (err) {
       throw toolError(err, context, "list_interface_lists");
@@ -12059,10 +12650,18 @@ var manageInterfaceListTool = {
   title: "Manage Interface List",
   description: "Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS \u2014 the error is surfaced as-is.",
   inputSchema: manageInterfaceListInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = manageInterfaceListInputSchema.parse(params);
-    log45.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing interface list");
+    log45.info(
+      { routerId: context.routerId, action: parsed.action, name: parsed.name },
+      "Managing interface list"
+    );
     try {
       const all = await context.routerClient.get("interface/list", {
         limit: void 0,
@@ -12133,11 +12732,21 @@ var manageInterfaceListMemberTool = {
   title: "Manage Interface List Member",
   description: "Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.",
   inputSchema: manageInterfaceListMemberInputSchema,
-  annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
   async handler(params, context) {
     const parsed = manageInterfaceListMemberInputSchema.parse(params);
     log45.info(
-      { routerId: context.routerId, action: parsed.action, list: parsed.list, interface: parsed.interface },
+      {
+        routerId: context.routerId,
+        action: parsed.action,
+        list: parsed.list,
+        interface: parsed.interface
+      },
       "Managing interface list member"
     );
     try {
@@ -12152,7 +12761,11 @@ var manageInterfaceListMemberTool = {
         if (existing) {
           return {
             content: `Interface "${parsed.interface}" is already a member of list "${parsed.list}". No changes made.`,
-            structuredContent: { action: "already_exists", list: parsed.list, interface: parsed.interface }
+            structuredContent: {
+              action: "already_exists",
+              list: parsed.list,
+              interface: parsed.interface
+            }
           };
         }
         if (parsed.dryRun) {
@@ -12167,16 +12780,28 @@ var manageInterfaceListMemberTool = {
         const body = { list: parsed.list, interface: parsed.interface };
         if (parsed.comment) body.comment = parsed.comment;
         const created = await context.routerClient.create("interface/list/member", body);
-        log45.info({ list: parsed.list, interface: parsed.interface, id: created[".id"] }, "Interface list member added");
+        log45.info(
+          { list: parsed.list, interface: parsed.interface, id: created[".id"] },
+          "Interface list member added"
+        );
         return {
           content: `Added "${parsed.interface}" to list "${parsed.list}".`,
-          structuredContent: { action: "created", list: parsed.list, interface: parsed.interface, id: created[".id"] }
+          structuredContent: {
+            action: "created",
+            list: parsed.list,
+            interface: parsed.interface,
+            id: created[".id"]
+          }
         };
       }
       if (!existing) {
         return {
           content: `Interface "${parsed.interface}" is not a member of list "${parsed.list}". Nothing to remove.`,
-          structuredContent: { action: "not_found", list: parsed.list, interface: parsed.interface }
+          structuredContent: {
+            action: "not_found",
+            list: parsed.list,
+            interface: parsed.interface
+          }
         };
       }
       if (parsed.dryRun) {
@@ -12647,7 +13272,11 @@ function checkAuthz(identity, toolName, routerId2) {
         category: "PERMISSION_DENIED" /* PERMISSION_DENIED */,
         code: "TOOL_NOT_ALLOWED",
         message: `Identity "${identity.id}" is not allowed to call tool "${toolName}".`,
-        details: { identityId: identity.id, toolName, allowedToolPatterns: identity.allowedToolPatterns },
+        details: {
+          identityId: identity.id,
+          toolName,
+          allowedToolPatterns: identity.allowedToolPatterns
+        },
         recoverability: {
           retryable: false,
           suggestedAction: `Add a matching pattern to allowedToolPatterns for identity "${identity.id}" in identities.yaml.`
@@ -12704,6 +13333,7 @@ function getCredentials(router) {
 
 // src/adapter/ssh-client.ts
 import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync3 } from "fs";
 import { Client } from "ssh2";
 var SshClient = class {
   constructor(config, credentials, options) {
@@ -12719,6 +13349,7 @@ var SshClient = class {
   async execute(command, overrideTimeoutMs) {
     const timeoutMs = overrideTimeoutMs ?? this.commandTimeoutMs;
     const maxOutputBytes = this.maxOutputBytes;
+    const privateKey = this.config.sshPrivateKeyPath ? readFileSync3(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client();
       const chunks = [];
@@ -12784,10 +13415,11 @@ var SshClient = class {
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
-        username: this.credentials.username,
-        password: this.credentials.password,
+        username: this.config.sshUsername ?? this.credentials.username,
         readyTimeout: 1e4
       };
+      if (privateKey) connectOptions.privateKey = privateKey;
+      else connectOptions.password = this.credentials.password;
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
@@ -12849,6 +13481,7 @@ var FtpClient = class {
 
 // src/adapter/sftp-client.ts
 import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync4 } from "fs";
 import { Client as Client3 } from "ssh2";
 var SftpClient = class {
   constructor(config, credentials) {
@@ -12858,6 +13491,7 @@ var SftpClient = class {
   config;
   credentials;
   async upload(remoteName, content) {
+    const privateKey = this.config.sshPrivateKeyPath ? readFileSync4(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client3();
       let settled = false;
@@ -12883,10 +13517,11 @@ var SftpClient = class {
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
-        username: this.credentials.username,
-        password: this.credentials.password,
+        username: this.config.sshUsername ?? this.credentials.username,
         readyTimeout: 1e4
       };
+      if (privateKey) connectOptions.privateKey = privateKey;
+      else connectOptions.password = this.credentials.password;
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
@@ -13465,17 +14100,20 @@ async function executeToolCall(tool, args, deps) {
       }
       const shouldAudit = tool.annotations.destructiveHint || !tool.annotations.readOnlyHint;
       if (shouldAudit) {
-        auditLog({
-          type: "audit",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          correlationId,
-          identityId: identity.id,
-          role: identity.role,
-          tool: tool.name,
-          routerId: routerId2,
-          phase: "attempt",
-          params: args
-        }, config.auditLogPath);
+        auditLog(
+          {
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId,
+            identityId: identity.id,
+            role: identity.role,
+            tool: tool.name,
+            routerId: routerId2,
+            phase: "attempt",
+            params: args
+          },
+          config.auditLogPath
+        );
       }
       const toolContext = buildRouterToolContext({
         routerConfig,
@@ -13492,7 +14130,12 @@ async function executeToolCall(tool, args, deps) {
       if (!tool.annotations.readOnlyHint) {
         for (const path of snapshotPathsFor(tool, handlerArgs)) {
           try {
-            const meta = await takeSnapshot(toolContext.deviceClient, routerId2, path, config.snapshotDir);
+            const meta = await takeSnapshot(
+              toolContext.deviceClient,
+              routerId2,
+              path,
+              config.snapshotDir
+            );
             snapshotIds.push(meta.id);
             log48.debug({ snapshotId: meta.id, path }, "Snapshot taken");
           } catch (err) {
@@ -13524,18 +14167,21 @@ async function executeToolCall(tool, args, deps) {
         });
       }
       if (shouldAudit) {
-        auditLog({
-          type: "audit",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          correlationId,
-          identityId: identity.id,
-          role: identity.role,
-          tool: tool.name,
-          routerId: routerId2,
-          phase: "success",
-          params: args,
-          durationMs: Date.now() - startMs
-        }, config.auditLogPath);
+        auditLog(
+          {
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId,
+            identityId: identity.id,
+            role: identity.role,
+            tool: tool.name,
+            routerId: routerId2,
+            phase: "success",
+            params: args,
+            durationMs: Date.now() - startMs
+          },
+          config.auditLogPath
+        );
       }
       log48.info({ tool: tool.name, routerId: routerId2, correlationId }, "Tool executed successfully");
       recordToolCall(tool.name, "success");
@@ -13565,19 +14211,22 @@ async function executeToolCall(tool, args, deps) {
       if (shouldAudit && error.category !== "APPROVAL_REQUIRED" /* APPROVAL_REQUIRED */) {
         const routerId2 = args.routerId ?? "unknown";
         const identity = getCurrentIdentity() ?? getStdioIdentity(config.stdioIdentity, identityRegistry);
-        auditLog({
-          type: "audit",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          correlationId,
-          identityId: identity.id,
-          role: identity.role,
-          tool: tool.name,
-          routerId: routerId2,
-          phase: "failure",
-          params: args,
-          outcome: error.code,
-          durationMs: Date.now() - startMs
-        }, config.auditLogPath);
+        auditLog(
+          {
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId,
+            identityId: identity.id,
+            role: identity.role,
+            tool: tool.name,
+            routerId: routerId2,
+            phase: "failure",
+            params: args,
+            outcome: error.code,
+            durationMs: Date.now() - startMs
+          },
+          config.auditLogPath
+        );
       }
       log48.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
       recordToolCall(tool.name, "error");
@@ -13716,10 +14365,16 @@ var listRoutersTool = {
     const total = rows.length;
     const header = `Routers: ${total === 0 ? "none" : `1-${total} of ${total}`}.`;
     const lines = rows.map(
-      (r) => `  ${compactFields(
-        { ...r, tags: r.tags.join(",") },
-        ["id", "host", "port", "deviceType", "tlsEnabled", "tags", "rosVersion", "isDefault"]
-      )}`
+      (r) => `  ${compactFields({ ...r, tags: r.tags.join(",") }, [
+        "id",
+        "host",
+        "port",
+        "deviceType",
+        "tlsEnabled",
+        "tags",
+        "rosVersion",
+        "isDefault"
+      ])}`
     );
     return {
       content: total === 0 ? header : [header, ...lines].join("\n"),
@@ -13808,17 +14463,20 @@ function createFleetTools(baseTools2) {
         { toolName: parsed.toolName, concurrency: parsed.concurrency },
         "bulk_execute invoked"
       );
-      auditLog({
-        type: "audit",
-        ts: (/* @__PURE__ */ new Date()).toISOString(),
-        correlationId: context.correlationId,
-        identityId: context.identity.id,
-        role: context.identity.role,
-        tool: "bulk_execute",
-        routerId: "(fleet)",
-        phase: "attempt",
-        params: { toolName: parsed.toolName, routerIds: parsed.routerIds, tags: parsed.tags }
-      }, context.appConfig.auditLogPath);
+      auditLog(
+        {
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId: context.correlationId,
+          identityId: context.identity.id,
+          role: context.identity.role,
+          tool: "bulk_execute",
+          routerId: "(fleet)",
+          phase: "attempt",
+          params: { toolName: parsed.toolName, routerIds: parsed.routerIds, tags: parsed.tags }
+        },
+        context.appConfig.auditLogPath
+      );
       if (parsed.toolName === "bulk_execute" || parsed.toolName === "check_router_health") {
         throw new MikroMCPError({
           category: "VALIDATION" /* VALIDATION */,
@@ -13891,17 +14549,20 @@ function createFleetTools(baseTools2) {
         );
       }
       if (routers.length === 0 && preErrors.length === 0) {
-        auditLog({
-          type: "audit",
-          ts: (/* @__PURE__ */ new Date()).toISOString(),
-          correlationId: context.correlationId,
-          identityId: context.identity.id,
-          role: context.identity.role,
-          tool: "bulk_execute",
-          routerId: "(fleet)",
-          phase: "success",
-          params: { toolName: parsed.toolName, succeeded: 0, failed: 0 }
-        }, context.appConfig.auditLogPath);
+        auditLog(
+          {
+            type: "audit",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            correlationId: context.correlationId,
+            identityId: context.identity.id,
+            role: context.identity.role,
+            tool: "bulk_execute",
+            routerId: "(fleet)",
+            phase: "success",
+            params: { toolName: parsed.toolName, succeeded: 0, failed: 0 }
+          },
+          context.appConfig.auditLogPath
+        );
         return {
           content: `Executed ${parsed.toolName} on 0 routers: 0 succeeded, 0 failed`,
           structuredContent: {
@@ -13934,7 +14595,10 @@ function createFleetTools(baseTools2) {
           const toolParams = { ...parsed.params, routerId: router.id };
           const snapshotIds = [];
           if (isWrite) {
-            for (const path of snapshotPathsFor(targetTool, toolParams)) {
+            for (const path of snapshotPathsFor(
+              targetTool,
+              toolParams
+            )) {
               try {
                 const meta = await takeSnapshot(
                   routerContext.deviceClient,
@@ -13971,40 +14635,57 @@ function createFleetTools(baseTools2) {
           );
           const elapsed = Date.now() - start;
           if (journalId) {
-            recordOutcome({ journalPath, journalId, phase: "success", durationMs: elapsed });
+            recordOutcome({
+              journalPath,
+              journalId,
+              phase: "success",
+              durationMs: elapsed
+            });
           }
-          auditLog({
-            type: "audit",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            correlationId: context.correlationId,
-            identityId: context.identity.id,
-            role: context.identity.role,
-            tool: parsed.toolName,
-            routerId: router.id,
-            phase: "success",
-            params: parsed.params,
-            durationMs: elapsed
-          }, context.appConfig.auditLogPath);
+          auditLog(
+            {
+              type: "audit",
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              correlationId: context.correlationId,
+              identityId: context.identity.id,
+              role: context.identity.role,
+              tool: parsed.toolName,
+              routerId: router.id,
+              phase: "success",
+              params: parsed.params,
+              durationMs: elapsed
+            },
+            context.appConfig.auditLogPath
+          );
           return { routerId: router.id, status: "ok", result, durationMs: elapsed };
         } catch (err) {
           const elapsed = Date.now() - start;
           const message = err instanceof Error ? err.message : String(err);
           if (journalId) {
-            recordOutcome({ journalPath, journalId, phase: "failure", outcome: message, durationMs: elapsed });
+            recordOutcome({
+              journalPath,
+              journalId,
+              phase: "failure",
+              outcome: message,
+              durationMs: elapsed
+            });
           }
-          auditLog({
-            type: "audit",
-            ts: (/* @__PURE__ */ new Date()).toISOString(),
-            correlationId: context.correlationId,
-            identityId: context.identity.id,
-            role: context.identity.role,
-            tool: parsed.toolName,
-            routerId: router.id,
-            phase: "failure",
-            params: parsed.params,
-            outcome: message,
-            durationMs: elapsed
-          }, context.appConfig.auditLogPath);
+          auditLog(
+            {
+              type: "audit",
+              ts: (/* @__PURE__ */ new Date()).toISOString(),
+              correlationId: context.correlationId,
+              identityId: context.identity.id,
+              role: context.identity.role,
+              tool: parsed.toolName,
+              routerId: router.id,
+              phase: "failure",
+              params: parsed.params,
+              outcome: message,
+              durationMs: elapsed
+            },
+            context.appConfig.auditLogPath
+          );
           return { routerId: router.id, status: "error", error: message, durationMs: elapsed };
         }
       }
@@ -14016,17 +14697,20 @@ function createFleetTools(baseTools2) {
       }
       const succeeded = results2.filter((r) => r.status === "ok").length;
       const failed = results2.filter((r) => r.status === "error").length;
-      auditLog({
-        type: "audit",
-        ts: (/* @__PURE__ */ new Date()).toISOString(),
-        correlationId: context.correlationId,
-        identityId: context.identity.id,
-        role: context.identity.role,
-        tool: "bulk_execute",
-        routerId: "(fleet)",
-        phase: "success",
-        params: { toolName: parsed.toolName, succeeded, failed }
-      }, context.appConfig.auditLogPath);
+      auditLog(
+        {
+          type: "audit",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          correlationId: context.correlationId,
+          identityId: context.identity.id,
+          role: context.identity.role,
+          tool: "bulk_execute",
+          routerId: "(fleet)",
+          phase: "success",
+          params: { toolName: parsed.toolName, succeeded, failed }
+        },
+        context.appConfig.auditLogPath
+      );
       return {
         content: `Executed ${parsed.toolName} on ${results2.length} routers: ${succeeded} succeeded, ${failed} failed`,
         structuredContent: {
@@ -14120,7 +14804,8 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
 }
 
 // src/config/router-registry.ts
-import { readFileSync as readFileSync3, existsSync } from "fs";
+import { readFileSync as readFileSync5, existsSync } from "fs";
+import { isAbsolute } from "path";
 import { parse } from "yaml";
 import { z as z49 } from "zod";
 var log51 = createLogger("router-registry");
@@ -14147,14 +14832,14 @@ var RouterConfigSchema = z49.object({
   tags: z49.array(z49.string()).default([]),
   rosVersion: z49.string().min(1).optional(),
   sshPort: z49.number().int().min(1).max(65535).optional(),
+  sshUsername: z49.string().min(1).optional(),
+  sshPrivateKeyPath: z49.string().min(1).refine(isAbsolute, "sshPrivateKeyPath must be absolute").optional(),
   sshFingerprint: z49.string().optional(),
   cmdAllow: z49.array(z49.string()).optional(),
   cmdDeny: z49.array(z49.string()).optional(),
   maintenanceWindows: z49.array(
     z49.object({
-      days: z49.array(
-        z49.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
-      ),
+      days: z49.array(z49.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])),
       startTime: z49.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
       endTime: z49.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
       timezone: z49.string().min(1)
@@ -14200,7 +14885,7 @@ var RouterRegistry = class {
       log51.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
-    const raw = readFileSync3(configPath, "utf-8");
+    const raw = readFileSync5(configPath, "utf-8");
     const parsed = parse(raw);
     const result = ConfigFileSchema.safeParse(parsed);
     if (!result.success) {
@@ -14230,7 +14915,18 @@ ${issues}`);
   getRouter(id) {
     const router = this.routers.get(id);
     if (!router) {
-      throw new Error(`Router not found: ${id}`);
+      const available = this.routerIds();
+      throw new MikroMCPError({
+        category: "NOT_FOUND" /* NOT_FOUND */,
+        code: "ROUTER_NOT_FOUND",
+        message: available.length > 0 ? `Router not found: ${id}. Available: ${available.join(", ")}.` : `Router not found: ${id}. No routers are configured.`,
+        details: { routerId: id, availableRouters: available },
+        recoverability: {
+          retryable: false,
+          suggestedAction: "Check the routerId, or use list_routers to see the configured routers.",
+          alternativeTools: ["list_routers"]
+        }
+      });
     }
     return router;
   }
@@ -14317,7 +15013,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.9.0";
+var VERSION = "1.11.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -14503,7 +15199,18 @@ async function connectHttp(makeServer, config, identityRegistry) {
         }
         const boundIdentity = identity;
         await withIdentity(boundIdentity, async () => {
-          await handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, makeServer, streamableSessions, sseTransports, boundIdentity.id);
+          await handleMcpRequest(
+            pathname,
+            req,
+            res,
+            url,
+            port,
+            maxBodyBytes,
+            makeServer,
+            streamableSessions,
+            sseTransports,
+            boundIdentity.id
+          );
         });
         return;
       }
@@ -14613,7 +15320,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 }
 
 // src/config/identity-registry.ts
-import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync2 } from "fs";
 import { createHash as createHash7 } from "crypto";
 import { parse as parse2 } from "yaml";
 import { z as z50 } from "zod";
@@ -14641,7 +15348,7 @@ var IdentityRegistry = class {
       );
       return;
     }
-    const raw = readFileSync4(configPath, "utf-8");
+    const raw = readFileSync6(configPath, "utf-8");
     const parsed = parse2(raw);
     const result = ConfigFileSchema2.safeParse(parsed);
     if (!result.success) {
@@ -14741,9 +15448,7 @@ async function runServe() {
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
-    const hasLimitedRoles = identityRegistry.getIdentities().some(
-      (i) => i.role === "readonly" || i.role === "operator"
-    );
+    const hasLimitedRoles = identityRegistry.getIdentities().some((i) => i.role === "readonly" || i.role === "operator");
     if (hasLimitedRoles && !config.confirmationSecret) {
       log55.error(
         "MIKROMCP_CONFIRMATION_SECRET is required in HTTP mode when identities with role readonly or operator are configured"
@@ -14782,11 +15487,11 @@ async function runServe() {
 }
 
 // src/cli/doctor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.9.0";
+var localVersion = "1.11.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -14883,7 +15588,9 @@ function checkDefaultRouter(defaultRouter, routers) {
   const ids = routers.map((r) => r.id);
   if (defaultRouter) {
     if (ids.includes(defaultRouter)) {
-      ok(`Default router: ${defaultRouter} (MIKROMCP_DEFAULT_ROUTER; used when routerId is omitted)`);
+      ok(
+        `Default router: ${defaultRouter} (MIKROMCP_DEFAULT_ROUTER; used when routerId is omitted)`
+      );
     } else {
       fail(
         `MIKROMCP_DEFAULT_ROUTER="${defaultRouter}" does not match any configured router` + (ids.length > 0 ? ` (available: ${ids.join(", ")})` : "")
@@ -14930,7 +15637,9 @@ async function checkRouter(router) {
         indentWarn(`read policy: ip/address returned ${code} \u2014 check user permissions`);
         results.push({ passed: true, warning: true });
       } else {
-        indentFail(`read policy: ip/address failed \u2014 ${readErr instanceof Error ? readErr.message : String(readErr)}`);
+        indentFail(
+          `read policy: ip/address failed \u2014 ${readErr instanceof Error ? readErr.message : String(readErr)}`
+        );
         results.push({ passed: false, warning: false });
       }
     }
@@ -14995,7 +15704,7 @@ function checkClaudeDesktop() {
     return;
   }
   try {
-    const raw = readFileSync5(configPath, "utf-8");
+    const raw = readFileSync7(configPath, "utf-8");
     const config = JSON.parse(raw);
     const servers = config.mcpServers ?? {};
     if ("mikromcp" in servers || "mikrotik-mcp-server" in servers) {
@@ -15013,7 +15722,9 @@ function checkClaudeDesktop() {
       );
     }
   } catch (err) {
-    warn(`Could not parse Claude Desktop config: ${err instanceof Error ? err.message : String(err)}`);
+    warn(
+      `Could not parse Claude Desktop config: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 function checkSkill() {
@@ -15092,13 +15803,7 @@ async function runDoctor() {
 // src/cli/init.ts
 import { input, confirm, select } from "@inquirer/prompts";
 import { randomBytes as randomBytes2 } from "crypto";
-import {
-  existsSync as existsSync4,
-  readFileSync as readFileSync6,
-  writeFileSync,
-  mkdirSync,
-  copyFileSync
-} from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync8, writeFileSync, mkdirSync, copyFileSync } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
 import { parse as yamlParse, Document, visit } from "yaml";
@@ -15199,7 +15904,18 @@ async function collectRouterInfo() {
     default: "7",
     validate: (v) => v.trim().length > 0 ? true : "Version is required"
   });
-  return { routerId: routerId2, host, port, tlsEnabled, rejectUnauthorized, envPrefix, routerUser, routerPass, tags, rosVersion };
+  return {
+    routerId: routerId2,
+    host,
+    port,
+    tlsEnabled,
+    rejectUnauthorized,
+    envPrefix,
+    routerUser,
+    routerPass,
+    tags,
+    rosVersion
+  };
 }
 async function collectDefaultRouterPreference(routerId2) {
   return confirm({
@@ -15266,7 +15982,10 @@ async function collectTransport() {
   const transport2 = await select({
     message: "Transport mode:",
     choices: [
-      { value: "stdio", name: "stdio  \u2014 launched by Claude Desktop or an MCP client (recommended)" },
+      {
+        value: "stdio",
+        name: "stdio  \u2014 launched by Claude Desktop or an MCP client (recommended)"
+      },
       { value: "http", name: "http   \u2014 standalone HTTP server with bearer-token auth" }
     ],
     default: "stdio"
@@ -15308,7 +16027,7 @@ function writeRoutersYaml(data) {
   };
   let parsed = { routers: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync6(filePath, "utf-8");
+    const raw = readFileSync8(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { routers: {} };
     if (!parsed.routers) parsed.routers = {};
   }
@@ -15327,7 +16046,7 @@ function writeIdentitiesYaml(data) {
   };
   let parsed = { identities: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync6(filePath, "utf-8");
+    const raw = readFileSync8(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { identities: {} };
     if (!parsed.identities) parsed.identities = {};
   }
@@ -15393,7 +16112,7 @@ function registerClaudeDesktop() {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${configPath}.backup-${timestamp}`;
   copyFileSync(configPath, backupPath);
-  const raw = readFileSync6(configPath, "utf-8");
+  const raw = readFileSync8(configPath, "utf-8");
   const config = JSON.parse(raw);
   if (!config.mcpServers || typeof config.mcpServers !== "object") {
     config.mcpServers = {};
@@ -15484,21 +16203,25 @@ async function runInit() {
   }
   if (data.createIdentity && data.rawToken) {
     console.log(
-      chalk2.bold.yellow(`  \u2705  Bearer token: ${data.rawToken} (save this \u2014 it won't be shown again)`)
+      chalk2.bold.yellow(
+        `  \u2705  Bearer token: ${data.rawToken} (save this \u2014 it won't be shown again)`
+      )
     );
   }
   console.log(chalk2.bold("\nNext steps:"));
   console.log(chalk2.dim("  1. Run: mikromcp doctor"));
   console.log(chalk2.dim("  2. Restart Claude Desktop to load the MCP server"));
   console.log(
-    chalk2.dim("  3. (Optional) Install the usage skill so your AI assistant drives MikroMCP safely")
+    chalk2.dim(
+      "  3. (Optional) Install the usage skill so your AI assistant drives MikroMCP safely"
+    )
   );
   console.log(chalk2.dim("     See: docs/wiki/Using-the-Skill.md"));
   console.log();
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.9.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.11.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);