@aristanetworks/eos-mcp-server 0.6.1-beta → 0.8.1-beta

package/CHANGELOG.md

@@ -2,7 +2,33 @@
 
 ## Unreleased
 
+## 0.8.1-beta
+
+- **Breaking:** removes the durable diagnostic ledger and its exclusive lock, so several MCP servers (for example two chat sessions, or the desktop app alongside Claude Code) can use the same inventory at once. Previously a second server failed to start whenever any host allowed diagnostics, losing every tool. See [ADR 0006](docs/adr/0006-in-memory-timed-diagnostic-capacity.md), which supersedes ADRs 0002 to 0004.
+- When a ping's remote completion is unknown (timeout, cancellation, lost connection, malformed or uncorrelated response), its slot is now held for `diagnostics.commandTimeoutMs` and then freed automatically instead of indefinitely; a late confirmed response frees it sooner. New work queues behind held slots within the overall deadline. Server info reports `releases_at` for each uncertain reservation. `deviceConcurrency` now limits each server process rather than an inventory.
+- Ping requests now send EOS's native `runCmds.requestTimeout`, set to `diagnostics.commandTimeoutMs`, so the switch itself interrupts a ping that outlives its budget. On by default; set `diagnostics.nativeRequestTimeout: false` if an EOS version rejects the field. Server info reports it as `limits.diagnostics.native_request_timeout`. Verified on cEOS 4.34.3M only.
+- Removes the `inspect-diagnostics` and `release-diagnostics` commands, fencing attestations and release audit, the `diagnostics.stateFile` setting (now rejected with guidance), the `diagnostic_capacity_uncertain` and `diagnostic_state_*` errors, and the capacity snapshot's `scope`, `storage_error_code` and `rpc_request_id` fields (`reservation_id` is the wire RPC ID). Old ledger files under `~/.local/state/eos-mcp-server/` are no longer read and can be deleted.
+
+## 0.8.0-beta
+
+0.7.0-beta was not published to npm, so upgrading from 0.6.1-beta picks up both this section and the 0.7.0-beta section below.
+
+- **Breaking:** `eos_ping` replaces `destination` with `destinations`, an array of 1 to `diagnostics.maxDestinationsPerRequest` (default 16) unique IP literals. Use `destinations: ["<ip>"]` for a single ping; the old field is rejected with guidance. Duplicates are compared by canonical address, so different IPv6 spellings of one address are rejected, while an IPv4 address and its IPv4-mapped IPv6 form stay distinct. Destinations run concurrently within the existing diagnostic concurrency, each with its own reservation. Results always contain one entry per host and destination, each carrying `destination`, and `summary` counts those entries rather than devices. All destinations are validated before dispatch, and `maxProbesPerRequest` now counts hosts × destinations × count. Server info reports `limits.diagnostics.max_destinations_per_request`. See [ADR 0005](docs/adr/0005-multi-destination-ping.md).
+- Routes diagnostics through a per-kind `DiagnosticDefinition` (prepare, probe cost, interpret), so the executor no longer contains ping-specific logic.
+- Documents the Codex `supports_parallel_tool_calls = true` opt-in in the README's Codex configuration examples. Without it, Codex runs independent EOS tool calls serially.
+- Refreshes locked dependencies with `npm audit fix`, including `@modelcontextprotocol/sdk` 1.32.2 and its HTTP-transport dependencies. One advisory remains: zod's memory exhaustion when validating oversized constrained collections is fixed only in zod 4, which needs a separate migration.
+
+## 0.7.0-beta
+
+- Refactors diagnostic queueing and reservation transitions into separate paths, makes pre-/post-dispatch error handling explicit, and shares audit hashing and snapshot normalization. Ledger formats, schema versions, and safety policy are unchanged; adds coverage for queued journal failure without invalidating already-completed work.
+- Retains uncertain diagnostic capacity for correlated malformed text results instead of mistaking validation failure for completion. Offline inspection now reads integrity, schema, reservations, and audit in one SQLite transaction, preventing mixed before/after release snapshots.
+- Adds offline `release-diagnostics` with exact ID scope, a private bounded fencing-attestation file, explicit confirmation, exclusive ledger ownership, and atomic audit-plus-release. Records actual OS identity separately from the claimed verifier and checks content digests; it does not verify fencing truth or expose an MCP reset. Schema 1 migrates transactionally to schema 2, preserving unresolved work; `inspect-diagnostics` exposes read-only audit history. Exact committed retries are no-ops; changed attestation reuse is rejected.
+- Validates JSON-RPC 2.0 response IDs and exclusive result/error envelopes before accepting output or retrying read-only JSON fallback. Missing/stale acknowledgements retain uncertain diagnostic capacity. New ledger reservations persist the exact wire RPC ID before dispatch; offline inspection distinguishes legacy records without one. IDs provide correlation, not an EOS status token or retry/deduplication guarantee.
+- Adds `eos_ping`: bounded IPv4/IPv6 diagnostics executed on inventory hosts/groups, optional VRF/source IP, normalized loss/RTT and reachability findings, and opt-in original EOS text. Requires inherited `mcp_diagnostics_allowed: true`; read denial still vetoes execution. No configuration changes, automatic retries, or SSH/shell fallback.
+- Fixes read-only auto output fallback for EOS code 1003 (`unconverted command`) and aligns optional read integration hostnames with the checked-in unprefixed topology. Ping's single-execution text path still never retries.
+- Adds configurable `diagnostics` limits/timeouts with sensible defaults, ledger-scoped admission across simultaneous calls, and indefinite fail-closed reservations when device completion is unknown. Reports permission in inventory views, effective limits and live reservation state in server info, and a structured `diagnostic_capacity_uncertain` error when uncertainty exhausts capacity. Reservations are committed before dispatch to a private, inventory-keyed SQLite ledger and survive restart as uncertain. A crash-released ownership lock prevents competing owners; storage errors fail closed. Adds optional `diagnostics.stateFile` and offline, read-only `inspect-diagnostics`. Offline operator-attested release is available; a machine-verified native remote deadline/completion facility remains unresolved; post-dispatch RPC interruption errors do not prove completion. Qualified on cEOS 4.34.3M; traceroute and packet capture remain future work.
 - Publishes the package to npm as `@aristanetworks/eos-mcp-server` (#14). The installed command is still `eos-mcp-server`. The release workflow publishes through npm trusted publishing, and prerelease tags go to the `next` dist-tag. The release tarball is now named `aristanetworks-eos-mcp-server-<version>.tgz`.
+- Upgrading from a `.tgz` install: run `npm uninstall -g eos-mcp-server` before `npm install -g @aristanetworks/eos-mcp-server`. Both packages provide the same `eos-mcp-server` command.
 
 ## 0.6.1-beta
 

package/README.md

@@ -1,11 +1,14 @@
-# eos-mcp-server BETA
+# eos-mcp-server
 
-Read-only MCP server for Arista EOS eAPI (JSON-RPC over HTTPS).
+[![Project status: Beta](https://img.shields.io/badge/status-beta-orange.svg)](https://github.com/aristanetworks/eos-mcp-server/releases)
+[![npm version](https://img.shields.io/npm/v/%40aristanetworks%2Feos-mcp-server.svg)](https://www.npmjs.com/package/@aristanetworks/eos-mcp-server)
+
+Read-only (non-configuring) MCP server for Arista EOS eAPI (JSON-RPC over HTTPS).
 
 > **Beta status:** this project is under active development.
 > **Support:** best-effort only. This open source project is not currently supported by Arista TAC.
 
-This server provides a set of **read-only** tools. It never exposes configuration-changing operations. The server can:
+This server never exposes configuration-changing operations. It provides read-only inspection and explicitly authorized, bounded **active diagnostics**. Non-configuring does not mean passive or harmless: diagnostics generate traffic. The server can:
 
 - introspect its own runtime and inventory
 - list inventory hosts/groups
@@ -14,8 +17,9 @@ This server provides a set of **read-only** tools. It never exposes configuratio
 - retrieve bounded logging output for troubleshooting
 - collect a fixed set of device facts
 - retrieve running configuration
+- run bounded ping diagnostics on EOS devices, including group fan-out
 
-> **Security note:** LLMs have occasionally tried to bypass the MCP server and make configuration changes through other means (for example, SSH). As a best practice, use AAA and scope the authentication credentials used by this server to read-only access.
+> **Security note:** LLMs have occasionally tried to bypass the MCP server and make configuration changes through other means (for example, SSH). As a best practice, use AAA and scope the authentication credentials used by this server to the intended inspection and diagnostic commands only.
 
 ## Contents
 
@@ -24,6 +28,7 @@ This server provides a set of **read-only** tools. It never exposes configuratio
 - [Install and get started](#install-and-get-started)
 - [Server config file](#server-config-file)
 - [Connect to an MCP client](#connect-to-an-mcp-client)
+- [Skills](#skills)
 - [CLI usage](#cli-usage)
 - [MCP tool reference](#mcp-tool-reference)
 - [Inventory formats](#inventory-formats)
@@ -39,6 +44,7 @@ Implemented MCP tools:
 - `eos_get_server_info`
 - `eos_list_inventory`
 - `eos_probe_devices`
+- `eos_ping`
 - `eos_run_show`
 - `eos_show_logging`
 - `eos_get_facts`
@@ -55,40 +61,68 @@ Implemented local CLI commands:
 
 - Node.js 24+
 - Arista EOS devices reachable via eAPI over HTTPS
-- EOS 4.20 or later
+- EOS 4.20 or later for existing read operations; `eos_ping` is qualified on cEOS 4.34.3M
 - Inventory in one of the supported YAML formats
 
 ## Install and get started
 
-1. Install the package globally from npm:
+The package is published on npm as [`@aristanetworks/eos-mcp-server`](https://www.npmjs.com/package/@aristanetworks/eos-mcp-server). The package provides the `eos-mcp-server` command.
 
-   ```bash
-   npm install -g @aristanetworks/eos-mcp-server
-   ```
+### npx or global install?
 
-   Prereleases are published under the `next` tag (`npm install -g @aristanetworks/eos-mcp-server@next`). Each [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) also attaches the package as a `.tgz`, which you can install with `npm install -g ./aristanetworks-eos-mcp-server-<version>.tgz`.
+Both run the same package. They differ in when the version changes and whether the npm registry must be reachable when the server starts.
 
-2. Confirm that the command is available:
+| Use                                                                                       | When                                                                                                                                                                                                          |
+| ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `npx -y @aristanetworks/eos-mcp-server`                                                   | You're trying the server out, or mainly run it from an MCP client. Nothing to install, and it picks up the latest release when it launches.                                                                   |
+| `npx -y @aristanetworks/eos-mcp-server@<version>`                                         | You want a reproducible setup, such as an MCP config shared with a team. Everyone runs the same version until you change it.                                                                                  |
+| `npm install -g @aristanetworks/eos-mcp-server`                                           | You run the CLI often, want to control when upgrades happen, or the npm registry isn't always reachable. The command starts without a registry lookup and stays on one version until you run `npm update -g`. |
+| `.tgz` from a [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) | The machine can't reach the npm registry at all.                                                                                                                                                              |
 
-   ```bash
-   eos-mcp-server --help
-   ```
+### Run with npx (recommended)
 
-The global install places `eos-mcp-server` on your `PATH`. To remove it later:
+No install step is needed. `npx` downloads the package on first use and caches it:
 
 ```bash
-npm uninstall -g @aristanetworks/eos-mcp-server
+npx -y @aristanetworks/eos-mcp-server --help
 ```
 
-Next, create an inventory, provide the device password, and validate connectivity:
+The [MCP client examples](#connect-to-an-mcp-client) below use `npx`. `-y` skips npm's install confirmation prompt, which an MCP client can't answer. Without a version, npx checks the registry for the latest release each time it launches the server. To pin a specific release, append a version, for example `@aristanetworks/eos-mcp-server@0.8.1-beta`.
+
+### Or install globally
+
+A global install puts `eos-mcp-server` on your `PATH`, starts without a registry lookup, and stays on the installed version until you update it:
+
+```bash
+npm install -g @aristanetworks/eos-mcp-server
+eos-mcp-server --help
+```
+
+Update it later with `npm update -g @aristanetworks/eos-mcp-server`, or remove it with `npm uninstall -g @aristanetworks/eos-mcp-server`.
+
+Prereleases are published under the `next` tag (`@aristanetworks/eos-mcp-server@next`). Each [GitHub release](https://github.com/aristanetworks/eos-mcp-server/releases) also attaches the package as a `.tgz`, for offline installs: `npm install -g ./aristanetworks-eos-mcp-server-<version>.tgz`.
+
+### Upgrading from a `.tgz` install
+
+Versions up to 0.6.1-beta were distributed as `.tgz` files under the unscoped package name `eos-mcp-server`. Both packages provide the same `eos-mcp-server` command, so remove the old package before switching to npm. Otherwise the global install can fail with a conflict, or the old version keeps running:
+
+```bash
+npm uninstall -g eos-mcp-server
+```
+
+### Validate your inventory
+
+Create an inventory, provide the device password, and validate connectivity:
 
 ```bash
 export EOS_MCP_PASSWORD='replace-with-device-password'
 
-eos-mcp-server validate-inventory --inventory inventory.yml
-eos-mcp-server probe --inventory inventory.yml --target leaf1
+npx -y @aristanetworks/eos-mcp-server validate-inventory --inventory inventory.yml
+npx -y @aristanetworks/eos-mcp-server probe --inventory inventory.yml --target leaf1
 ```
 
+With a global install, run `eos-mcp-server` in place of `npx -y @aristanetworks/eos-mcp-server`. The [CLI usage](#cli-usage) examples later in this README use the shorter `eos-mcp-server` form.
+
 See [Quickstart](docs/QUICKSTART.md) for a complete inventory example and MCP client setup. For building or contributing from source, see the [developer workflow](docs/DEVELOPMENT.md).
 
 ## Server config file
@@ -114,6 +148,17 @@ maxShowCommandsPerRequest: 5
 maxLoggingMessagesPerRequest: 1000
 maxResponseSizeBytes: 1048576
 eapiVersion: latest
+diagnostics:
+  defaultPingCount: 3
+  maxPingCount: 10
+  maxProbesPerRequest: 100
+  maxDestinationsPerRequest: 16
+  deviceConcurrency: 5
+  pingReplyTimeoutMs: 1000
+  commandTimeoutMs: 30000
+  httpTimeoutMs: 35000
+  overallOperationTimeoutMs: 60000
+  nativeRequestTimeout: true
 secretEnvPrefixes:
   - EOS_MCP_
 defaultConnection:
@@ -126,6 +171,7 @@ Supported config fields:
 
 - `inventory`
 - `actor`
+- `logFile`
 - `caFile`
 - `readTimeoutMs`
 - `overallOperationTimeoutMs`
@@ -135,30 +181,41 @@ Supported config fields:
 - `maxLoggingMessagesPerRequest`
 - `maxResponseSizeBytes`
 - `eapiVersion`
+- `diagnostics` — optional limits/timeouts mapping; see [Network diagnostics](docs/DIAGNOSTICS.md#settings-and-defaults)
 - `secretEnvPrefixes`
 - `defaultConnection.ansibleUser`
 - `defaultConnection.ansibleHttpapiPort`
 - `defaultConnection.mcpValidateCerts`
 - `defaultConnection.mcpPasswordEnv`
 
-`readTimeoutMs` applies to each device eAPI request. `overallOperationTimeoutMs`, when set, bounds the whole tool call and aborts in-flight device requests once the limit is reached. `maxLoggingMessagesPerRequest` caps `eos_show_logging.message_count` and defaults to 1000. `maxResponseSizeBytes` limits both the buffered HTTP response from each device and the final serialized read-tool result. `eapiVersion` selects the eAPI JSON output schema sent as the `runCmds` `version` parameter: `latest` (the default) returns the current schema for each command, and `1` pins the original schema for consumers that depend on it. It only affects JSON output, so `eos_get_running_config` and `eos_show_logging` are unchanged.
+For read tools, `readTimeoutMs` applies to each device eAPI request. `overallOperationTimeoutMs`, when set, bounds the whole read-tool call and aborts in-flight device requests once the limit is reached. `maxLoggingMessagesPerRequest` caps `eos_show_logging.message_count` and defaults to 1000. `maxResponseSizeBytes` limits both the buffered HTTP response from each device and the final serialized result of device read operations. `eapiVersion` selects the eAPI JSON output schema sent as the `runCmds` `version` parameter: `latest` (the default) returns the current schema for each command, and `1` pins the original schema for consumers that depend on it. It only affects JSON output, so `eos_get_running_config` and `eos_show_logging` are unchanged.
+
+`eos_ping` uses its own configurable `diagnostics` timeouts and per-server concurrency, while sharing `maxReadTargets` and `maxResponseSizeBytes`. Omitted diagnostic settings retain the defaults shown above; invalid or contradictory settings fail validation. Ping requires explicit inventory permission and has no automatic retries. Response IDs and protocol envelopes are validated before output is accepted. When a ping's remote completion is unknown (timeout, cancellation, lost connection), its slot is held for `commandTimeoutMs` and then freed automatically; inspect the running server's `eos_get_server_info.diagnostics.capacity`. Capacity lives in memory, so several MCP servers can use the same inventory at once. See [Network diagnostics](docs/DIAGNOSTICS.md), including the distinction between a reply timeout, command budget, and remote process termination.
+
+`actor` and `logFile` remain sanitized runtime metadata and do not enable a general tool-call audit log.
 
 `defaultConnection.mcpPasswordEnv` is a fallback password source. A host or inherited inventory value for `mcp_password_env` or `ansible_password` overrides it. Setting both `mcp_password_env` and `ansible_password` for the same host remains invalid.
 
 ## Connect to an MCP client
 
-These examples assume you've already installed `eos-mcp-server` per [Install and get started](#install-and-get-started) above, and have an inventory file (and optionally a [server config file](#server-config-file)) ready.
+These examples assume you have an inventory file (and optionally a [server config file](#server-config-file)) ready. They launch the server with `npx`, so nothing needs to be installed first. If you [installed globally](#or-install-globally), use `eos-mcp-server` as the command and drop `-y @aristanetworks/eos-mcp-server` from the arguments.
 
 ### Generic stdio example
 
-If `eos-mcp-server` is installed on your `PATH`, point it at just an inventory file:
+Point the server at just an inventory file:
 
 ```json
 {
   "mcpServers": {
     "eos": {
-      "command": "eos-mcp-server",
-      "args": ["serve", "--inventory", "/absolute/path/to/inventory.yml"]
+      "command": "npx",
+      "args": [
+        "-y",
+        "@aristanetworks/eos-mcp-server",
+        "serve",
+        "--inventory",
+        "/absolute/path/to/inventory.yml"
+      ]
     }
   }
 }
@@ -170,33 +227,39 @@ Or use a [server config file](#server-config-file) if you want to set additional
 {
   "mcpServers": {
     "eos": {
-      "command": "eos-mcp-server",
-      "args": ["serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
+      "command": "npx",
+      "args": [
+        "-y",
+        "@aristanetworks/eos-mcp-server",
+        "serve",
+        "--config",
+        "/absolute/path/to/eos-mcp-server.yml"
+      ]
     }
   }
 }
 ```
 
-If you built the project locally instead of installing the package, replace `"command": "eos-mcp-server"` with `"command": "node"` and put `/absolute/path/to/eos-mcp-server/dist/index.js` first in `args`.
+If you built the project locally instead, use `"command": "node"` and put `/absolute/path/to/eos-mcp-server/dist/index.js` first in `args`, in place of `-y` and the package name.
 
 ### Claude Code
 
 With just an inventory file:
 
 ```bash
-claude mcp add eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+claude mcp add eos -- npx -y @aristanetworks/eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
 ```
 
 Or with a [server config file](#server-config-file) for additional options:
 
 ```bash
-claude mcp add eos -- eos-mcp-server serve --config /absolute/path/to/eos-mcp-server.yml
+claude mcp add eos -- npx -y @aristanetworks/eos-mcp-server serve --config /absolute/path/to/eos-mcp-server.yml
 ```
 
 Add `-s user` before `eos` in either command to make the server available across all your projects instead of just the current one:
 
 ```bash
-claude mcp add -s user eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+claude mcp add -s user eos -- npx -y @aristanetworks/eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
 ```
 
 ### Codex
@@ -208,8 +271,9 @@ With just an inventory file:
 
 ```toml
 [mcp_servers.eos]
-command = "eos-mcp-server"
-args = ["serve", "--inventory", "/absolute/path/to/inventory.yml"]
+supports_parallel_tool_calls = true
+command = "npx"
+args = ["-y", "@aristanetworks/eos-mcp-server", "serve", "--inventory", "/absolute/path/to/inventory.yml"]
 env_vars = ["EOS_MCP_PASSWORD"]
 ```
 
@@ -217,24 +281,42 @@ Or with a [server config file](#server-config-file) for additional options:
 
 ```toml
 [mcp_servers.eos]
-command = "eos-mcp-server"
-args = ["serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
+supports_parallel_tool_calls = true
+command = "npx"
+args = ["-y", "@aristanetworks/eos-mcp-server", "serve", "--config", "/absolute/path/to/eos-mcp-server.yml"]
 env_vars = ["EOS_MCP_PASSWORD"]
 ```
 
+Set `supports_parallel_tool_calls = true` under `[mcp_servers.eos]` to let
+Codex dispatch independent tool calls, including pings, concurrently. Without
+this opt-in, tools that omit the MCP read-only annotation may run serially even
+when requested together. Reload Codex after changing the setting. The server
+still enforces its configured diagnostic concurrency and packet limits.
+A single `eos_ping` call with several `destinations` already runs them
+concurrently on the server, so this setting matters for other independent
+calls, such as show commands on different devices or pings that need different
+VRFs, sources, or counts.
+
 `serve` is optional because it is the default command, but is shown explicitly
-here for clarity. You can also add the server with:
+here for clarity. After exporting the password, you can also add the server and
+pass its current value through with the Codex CLI:
 
 ```bash
-codex mcp add eos -- eos-mcp-server serve --inventory /absolute/path/to/inventory.yml
+export EOS_MCP_PASSWORD='replace-with-device-password'
+
+codex mcp add eos \
+  --env EOS_MCP_PASSWORD="$EOS_MCP_PASSWORD" \
+  -- npx -y @aristanetworks/eos-mcp-server serve \
+  --inventory /absolute/path/to/inventory.yml
 ```
 
-Then add `env_vars = ["EOS_MCP_PASSWORD"]` to the generated
-`[mcp_servers.eos]` table.
+The `--env` form stores the expanded value in the generated Codex configuration.
+To have Codex read the variable from its environment each time it starts the
+server, use `env_vars = ["EOS_MCP_PASSWORD"]` as in the TOML examples above.
 
 ### Passing secrets to the MCP server
 
-Prefer exporting secrets in the environment that launches the MCP client:
+To export secrets in the environment that launches the MCP client use:
 
 ```bash
 export EOS_MCP_PASSWORD='super-secret'
@@ -244,6 +326,30 @@ For Codex, `env_vars = ["EOS_MCP_PASSWORD"]` forwards that exported variable to
 the server. Other MCP clients may support per-server `env` blocks. Avoid
 committing secret values to client config files when possible.
 
+## Skills
+
+The [`skills/`](skills/) folder holds community-created skills for everyday network operations workflows. Each skill is a `SKILL.md` file that teaches an AI assistant, such as Claude Code or Codex, how to carry out one workflow with this server's read-only tools: which `show` commands to run, how to read the output, what to investigate next, and how to report results.
+
+The current skills cover:
+
+- **Health checks:** BGP, EVPN and EVPN multicast, interfaces, Port-Channels/LACP, VLANs, routing tables and VRFs, IGMP snooping, and PIM.
+- **Validation:** ISIS Segment Routing, RFC 9721 EVPN IP mobility, and MCS/CVX configuration.
+- **Troubleshooting:** multicast flows that are missing, dropping, or corrupted; PTP grandmaster and connectivity problems; Segment Routing faults; and MCS mounts and agents.
+
+See [`skills/README.md`](skills/README.md) for the full list and for how to load the skills into Claude Code or Codex. Skills aren't included in the npm package, so clone this repository to use them.
+
+### Contribute a skill
+
+If you have a workflow you run by hand, such as a check you do after a change window, a runbook for a recurring problem, or an audit for a feature your network depends on, consider contributing it as a skill so other network engineers can use it too.
+
+1. Add `skills/<skill-name>/SKILL.md` with `name`, `description`, `trigger`, and `allowed-tools` frontmatter. The existing skills are good templates.
+2. Keep it **read-only**, and keep it **generic**: no site-specific hostnames, group names, or inventory layouts.
+3. Document the EOS commands the skill runs, the JSON fields it relies on, and what to check when something looks wrong.
+4. Add a row for the skill to the table in [`skills/README.md`](skills/README.md).
+5. Open a pull request that changes only files under `skills/`.
+
+Pull requests that touch only `skills/` can be accepted without a contributor license agreement. They are licensed under Apache-2.0. See [CONTRIBUTING.md](CONTRIBUTING.md) for details, and [Writing a new skill](skills/README.md#writing-a-new-skill) for the full guidelines. Improvements to existing skills are welcome too, such as coverage for another EOS feature, a better diagnostic drill-down, or a fix for output that changed between EOS releases.
+
 ## Inventory formats
 
 The server supports exactly one inventory file loaded at startup. The inventory is not watched for changes — to pick up inventory edits, restart the server. Most MCP clients will do this automatically when you restart the client or re-launch the MCP connection.
@@ -326,6 +432,8 @@ still using their individual credentials.
   - `mcp_platform: arista_eos`
 - `mcp_read_allowed` defaults to `true` for eligible EOS hosts. Set it to `false` — inherited like any other variable — to explicitly deny read access to a host or group.
 - Read operations fail closed if the resolved target contains ineligible or read-denied hosts.
+- `mcp_diagnostics_allowed` defaults to `false`. Set this inherited boolean to `true` to permit `eos_ping`; read denial still vetoes diagnostics. A mixed-permission group fails before any dispatch.
+- A diagnostic destination is distinct from the inventory target and may be an address outside inventory.
 
 ## Connection and authentication
 
@@ -407,7 +515,7 @@ caFile: /path/to/ca.pem
 
 ## CLI usage
 
-If no subcommand is provided, the CLI defaults to `serve`.
+If no subcommand is provided, the CLI defaults to `serve`. These examples use the globally installed `eos-mcp-server` command; with npx, run `npx -y @aristanetworks/eos-mcp-server` in its place.
 
 ### `serve`
 
@@ -462,7 +570,7 @@ Devices: 1/1 succeeded
 
 ### `eos_get_server_info`
 
-Returns a sanitized summary of server runtime, capabilities, limits, TLS/config posture, and inventory summary.
+Returns a sanitized summary of server runtime, capabilities, limits, TLS/config posture, inventory summary, and live active/uncertain diagnostic reservations. Reservation metadata excludes destinations, credentials, and original EOS output.
 
 Input:
 
@@ -495,6 +603,23 @@ Input:
 }
 ```
 
+### `eos_ping`
+
+Runs bounded ping from an inventory host or group to one or more destinations, requiring inherited `mcp_diagnostics_allowed: true`. It generates traffic without changing configuration. Each destination must be a unicast IPv4/IPv6 literal, and duplicates are rejected, including different spellings of the same IPv6 address; use a one-element `destinations` array for a single ping. Destinations run concurrently within the server's diagnostic concurrency, up to 16 per call by default. Optional VRF and source IP apply to every destination and never silently fall back. Count defaults to 3 per destination and is capped at 10 unless changed in settings.
+
+```json
+{
+  "target": "leaf1",
+  "destinations": ["192.0.2.10", "192.0.2.20"],
+  "count": 3,
+  "vrf": "BLUE",
+  "source": "192.0.2.11",
+  "include_raw": false
+}
+```
+
+`count`, `vrf`, `source`, and `include_raw` are optional. Results contain one entry per host and destination, each naming its `destination`; `summary` counts those entries. Results separate execution status from `reachable`/`partial`/`unreachable` findings and include loss/RTT measurements. Zero replies do not establish a cause. See [Network diagnostics](docs/DIAGNOSTICS.md) for all limits, address restrictions, lifecycle caveats, and result semantics. Traceroute and packet capture are not yet implemented.
+
 ### `eos_run_show`
 
 Runs one or more `show` commands.
@@ -624,18 +749,20 @@ This means the target resolved to at least one host that is either not marked as
 
 The read-path tools have been validated against EOS 4.34.3M. The minimum supported EOS version for read operations is 4.20, which is when eAPI JSON-RPC became stable and `show` commands reliably produce structured JSON output.
 
+`eos_ping` has separately been validated on cEOS 4.34.3M. Older EOS versions and physical platforms have not been qualified for this new tool.
+
 ## Design notes
 
-- inventory is the trust boundary
+- inventory is the execution-target trust boundary; diagnostic destinations may be outside inventory
 - reads are fail-closed on ineligible or denied targets
-- the server exposes only documented read-only operations
+- the server exposes only documented non-configuring operations; active diagnostics require explicit opt-in
 
 ## Project docs
 
 Additional design and planning docs in the `docs/` directory:
 
-- `docs/design-overview.md` — design overview for evaluators
 - `docs/DESIGN.md` — detailed design specification
+- `docs/DIAGNOSTICS.md` — ping usage, settings, safety, lifecycle, and extension seam
 - `docs/IMPLEMENTATION_PLAN.md` — implemented scope and maintenance priorities
 - `docs/CHECKPOINT.md` — current implementation status
 - `docs/CODE_WALKTHROUGH.md` — source layout and module guide

package/dist/config/diagnostics.d.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+export declare const diagnosticsConfigSchema: z.ZodEffects<z.ZodObject<{
+    stateFile: z.ZodOptional<z.ZodNever>;
+    defaultPingCount: z.ZodDefault<z.ZodNumber>;
+    maxPingCount: z.ZodDefault<z.ZodNumber>;
+    maxProbesPerRequest: z.ZodDefault<z.ZodNumber>;
+    maxDestinationsPerRequest: z.ZodDefault<z.ZodNumber>;
+    deviceConcurrency: z.ZodDefault<z.ZodNumber>;
+    pingReplyTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    commandTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    httpTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    overallOperationTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    nativeRequestTimeout: z.ZodDefault<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    defaultPingCount: number;
+    maxPingCount: number;
+    maxProbesPerRequest: number;
+    maxDestinationsPerRequest: number;
+    deviceConcurrency: number;
+    pingReplyTimeoutMs: number;
+    commandTimeoutMs: number;
+    httpTimeoutMs: number;
+    overallOperationTimeoutMs: number;
+    nativeRequestTimeout: boolean;
+    stateFile?: undefined;
+}, {
+    stateFile?: undefined;
+    defaultPingCount?: number | undefined;
+    maxPingCount?: number | undefined;
+    maxProbesPerRequest?: number | undefined;
+    maxDestinationsPerRequest?: number | undefined;
+    deviceConcurrency?: number | undefined;
+    pingReplyTimeoutMs?: number | undefined;
+    commandTimeoutMs?: number | undefined;
+    httpTimeoutMs?: number | undefined;
+    overallOperationTimeoutMs?: number | undefined;
+    nativeRequestTimeout?: boolean | undefined;
+}>, {
+    defaultPingCount: number;
+    maxPingCount: number;
+    maxProbesPerRequest: number;
+    maxDestinationsPerRequest: number;
+    deviceConcurrency: number;
+    pingReplyTimeoutMs: number;
+    commandTimeoutMs: number;
+    httpTimeoutMs: number;
+    overallOperationTimeoutMs: number;
+    nativeRequestTimeout: boolean;
+    stateFile?: undefined;
+}, {
+    stateFile?: undefined;
+    defaultPingCount?: number | undefined;
+    maxPingCount?: number | undefined;
+    maxProbesPerRequest?: number | undefined;
+    maxDestinationsPerRequest?: number | undefined;
+    deviceConcurrency?: number | undefined;
+    pingReplyTimeoutMs?: number | undefined;
+    commandTimeoutMs?: number | undefined;
+    httpTimeoutMs?: number | undefined;
+    overallOperationTimeoutMs?: number | undefined;
+    nativeRequestTimeout?: boolean | undefined;
+}>;
+/** Conservative bound: finite probes, fixed 1s spacing, reply waits, and scheduling margin. */
+export declare function pingExecutionBoundMs(count: number, replyTimeoutMs: number): number;
+export type DiagnosticsConfig = z.infer<typeof diagnosticsConfigSchema>;

package/dist/config/diagnostics.js

@@ -0,0 +1,38 @@
+import { z } from "zod";
+// Node timers must not overflow into an effectively immediate timeout.
+const MAX_TIMER_MS = 2_147_483_647;
+const positiveInteger = z.number().int().positive().max(MAX_TIMER_MS);
+export const diagnosticsConfigSchema = z.object({
+    stateFile: z.never({ message: "Removed: diagnostic capacity is now held in memory (ADR 0006); delete this setting" }).optional(),
+    defaultPingCount: positiveInteger.default(3),
+    maxPingCount: positiveInteger.default(10),
+    maxProbesPerRequest: positiveInteger.default(100),
+    maxDestinationsPerRequest: positiveInteger.default(16),
+    deviceConcurrency: positiveInteger.default(5),
+    pingReplyTimeoutMs: positiveInteger.multipleOf(1000).default(1000),
+    commandTimeoutMs: positiveInteger.default(30_000),
+    httpTimeoutMs: positiveInteger.default(35_000),
+    overallOperationTimeoutMs: positiveInteger.default(60_000),
+    nativeRequestTimeout: z.boolean().default(true)
+}).strict().superRefine((config, context) => {
+    const invalid = (path, message) => {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: [path], message });
+    };
+    if (config.defaultPingCount > config.maxPingCount) {
+        invalid("defaultPingCount", "Must not exceed maxPingCount");
+    }
+    if (config.maxPingCount > config.maxProbesPerRequest) {
+        invalid("maxPingCount", "Must not exceed maxProbesPerRequest");
+    }
+    if (pingExecutionBoundMs(config.maxPingCount, config.pingReplyTimeoutMs) > config.commandTimeoutMs) {
+        invalid("commandTimeoutMs", "Must cover maxPingCount * (pingReplyTimeoutMs + 1000) + 1000 ms");
+    }
+    if (config.httpTimeoutMs < config.commandTimeoutMs + 1000) {
+        invalid("httpTimeoutMs", "Must exceed commandTimeoutMs by at least 1000 ms");
+    }
+});
+/** Conservative bound: finite probes, fixed 1s spacing, reply waits, and scheduling margin. */
+export function pingExecutionBoundMs(count, replyTimeoutMs) {
+    return count * (1000 + replyTimeoutMs) + 1000;
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/config/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/config/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,uEAAuE;AACvE,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,oFAAoF,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChI,gBAAgB,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,mBAAmB,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;IACjD,yBAAyB,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,iBAAiB,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,kBAAkB,EAAE,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAClE,gBAAgB,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;IACjD,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9C,yBAAyB,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1D,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAAe,EAAQ,EAAE;QACtD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QAClD,OAAO,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACrD,OAAO,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnG,OAAO,CAAC,kBAAkB,EAAE,iEAAiE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,gBAAgB,GAAG,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,cAAsB;IACxE,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,GAAG,IAAI,CAAC;AAChD,CAAC"}

package/dist/config/loadConfig.js

@@ -19,6 +19,7 @@ export async function loadServerConfig(options) {
     }
     const merged = {
         configPath: resolvedConfigPath,
+        diagnostics: fileConfig.diagnostics,
         inventoryPath: resolveMaybePath(fileConfig.inventory, resolvedConfigPath),
         actor: fileConfig.actor,
         logFile: resolveMaybePath(fileConfig.logFile, resolvedConfigPath),

package/dist/config/loadConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadConfig.js","sourceRoot":"","sources":["../../src/config/loadConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAGvB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB;IACxD,IAAI,UAAU,GAAqB,EAAE,CAAC;IACtC,IAAI,kBAAsC,CAAC;IAE3C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,+BAA+B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,kBAAkB;QAC9B,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACzE,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACjE,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAC/D,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;QAC/D,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;QAC/D,4BAA4B,EAAE,UAAU,CAAC,4BAA4B;QACrE,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,OAAO,iBAAiB,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,gCAAgC,UAAU,KAAK,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,UAA8B;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAc,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,0BAA0B,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC3E,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"loadConfig.js","sourceRoot":"","sources":["../../src/config/loadConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAGvB,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB;IACxD,IAAI,UAAU,GAAqB,EAAE,CAAC;IACtC,IAAI,kBAAsC,CAAC;IAE3C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,kBAAkB,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,+BAA+B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,kBAAkB;QAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,gBAAgB,CAAC,UAAU,CAAC,SAAS,EAAE,kBAAkB,CAAC;QACzE,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACjE,MAAM,EAAE,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,kBAAkB,CAAC;QAC/D,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;QAC/D,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,yBAAyB,EAAE,UAAU,CAAC,yBAAyB;QAC/D,4BAA4B,EAAE,UAAU,CAAC,4BAA4B;QACrE,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;QACrD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;KAChD,CAAC;IAEF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED,OAAO,iBAAiB,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACtG,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,gCAAgC,UAAU,KAAK,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,UAA8B;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAI,KAAc,EAAE,IAAY;IACxD,IAAI,CAAC;QACH,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,0BAA0B,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC3E,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAe;IACtC,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}