@occam-scaly/mcp-server 0.1.2

package/dist/tools/write.js

@@ -0,0 +1,900 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeTools = void 0;
+const zod_1 = require("zod");
+const client_js_1 = require("../client.js");
+const index_js_1 = require("./index.js");
+function estimateDbMonthlyUsd(size) {
+    return ({
+        Micro: 10,
+        Small: 20,
+        Medium: 40,
+        Large: 80,
+        XLarge: 160
+    }[size] ?? 20);
+}
+function estimateStackMonthlyUsd(size) {
+    return ({
+        Eco: 8,
+        Basic: 16,
+        Standard_1X: 32,
+        Standard_2X: 64,
+        Performance_M: 128,
+        Performance_L: 256
+    }[size] ?? 16);
+}
+async function resolveAccountId(explicit) {
+    if (explicit)
+        return explicit;
+    const result = await (0, client_js_1.query)(`
+    query ResolveAccountId {
+      listStacks(take: 1) { accountId }
+    }
+  `);
+    return result.listStacks?.[0]?.accountId ?? null;
+}
+async function getStackById(stackId) {
+    const result = await (0, client_js_1.query)(`
+      query GetStack($where: StackWhereUniqueInput!) {
+        getStack(where: $where) { id name accountId size minIdle }
+      }
+    `, { where: { id: stackId } });
+    return result.getStack || null;
+}
+async function getAppById(appId) {
+    const result = await (0, client_js_1.query)(`
+      query GetApp($where: AppWhereUniqueInput!) {
+        getApp(where: $where) { id name accountId stackId }
+      }
+    `, { where: { id: appId } });
+    return result.getApp || null;
+}
+async function getAddOnById(addonId) {
+    const result = await (0, client_js_1.query)(`
+      query GetAddOn($where: AddOnWhereUniqueInput!) {
+        getAddOn(where: $where) { id name type accountId }
+      }
+    `, { where: { id: addonId } });
+    return result.getAddOn || null;
+}
+async function stackExistsByName(accountId, name) {
+    const gql = `
+    query FindStackByName($accountId: String!, $name: String!) {
+      listStacks(
+        where: {
+          AND: [
+            { accountId: { equals: $accountId } }
+            { name: { equals: $name } }
+            { isDeleted: { equals: false } }
+          ]
+        }
+        take: 5
+      ) { id name }
+    }
+  `;
+    const result = await (0, client_js_1.query)(gql, { accountId, name });
+    return result.listStacks || [];
+}
+async function appExistsByName(accountId, name) {
+    const gql = `
+    query FindAppByName($accountId: String!, $name: String!) {
+      listApps(
+        where: {
+          AND: [
+            { accountId: { equals: $accountId } }
+            { name: { equals: $name } }
+            { isDeleted: { equals: false } }
+          ]
+        }
+        take: 5
+      ) { id name stackId }
+    }
+  `;
+    const result = await (0, client_js_1.query)(gql, { accountId, name });
+    return result.listApps || [];
+}
+async function addOnExistsByName(accountId, name) {
+    const gql = `
+    query FindAddOnByName($accountId: String!, $name: String!) {
+      listAddOns(
+        where: {
+          AND: [
+            { accountId: { equals: $accountId } }
+            { name: { equals: $name } }
+            { isDeleted: { equals: false } }
+          ]
+        }
+        take: 5
+      ) { id name type }
+    }
+  `;
+    const result = await (0, client_js_1.query)(gql, { accountId, name });
+    return result.listAddOns || [];
+}
+const CreateStackSchema = zod_1.z.object({
+    account_id: zod_1.z
+        .string()
+        .optional()
+        .describe('Account ID. If omitted, Scaly will infer from your accessible stacks.'),
+    name: zod_1.z.string().min(1).describe('Stack name'),
+    size: zod_1.z
+        .enum([
+        'Eco',
+        'Basic',
+        'Standard_1X',
+        'Standard_2X',
+        'Performance_M',
+        'Performance_L'
+    ])
+        .describe('Stack size'),
+    region: zod_1.z
+        .enum(['CANADA', 'US', 'EU', 'ASIA_PACIFIC'])
+        .optional()
+        .describe('Informational only (region is derived from account today)'),
+    min_idle: zod_1.z
+        .number()
+        .int()
+        .min(0)
+        .optional()
+        .describe('Minimum warm instances'),
+    preview: zod_1.z
+        .boolean()
+        .default(true)
+        .describe('If true, returns what would change without executing')
+});
+const UpdateStackSchema = zod_1.z.object({
+    stack_id: zod_1.z.string().describe('Stack ID'),
+    size: zod_1.z
+        .enum([
+        'Eco',
+        'Basic',
+        'Standard_1X',
+        'Standard_2X',
+        'Performance_M',
+        'Performance_L'
+    ])
+        .optional(),
+    min_idle: zod_1.z.number().int().min(0).optional(),
+    preview: zod_1.z.boolean().default(true)
+});
+const DeleteStackSchema = zod_1.z.object({
+    stack_id: zod_1.z.string().describe('Stack ID'),
+    confirm: zod_1.z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe('Must be true to delete'),
+    preview: zod_1.z.boolean().default(true)
+});
+const CreateDatabaseSchema = zod_1.z.object({
+    account_id: zod_1.z
+        .string()
+        .optional()
+        .describe('Account ID. If omitted, Scaly will infer from your accessible stacks.'),
+    name: zod_1.z.string().min(1).describe('Database add-on name'),
+    engine: zod_1.z
+        .enum(['POSTGRES_14', 'POSTGRES_16', 'MYSQL_80'])
+        .default('POSTGRES_16'),
+    size: zod_1.z
+        .enum(['Micro', 'Small', 'Medium', 'Large', 'XLarge'])
+        .default('Small'),
+    preview: zod_1.z.boolean().default(true)
+});
+const CreateStorageSchema = zod_1.z.object({
+    account_id: zod_1.z
+        .string()
+        .optional()
+        .describe('Account ID. If omitted, Scaly will infer from your accessible stacks.'),
+    name: zod_1.z.string().min(1).describe('Storage add-on name'),
+    preview: zod_1.z.boolean().default(true)
+});
+const PasswordPolicySchema = zod_1.z
+    .object({
+    minimum_length: zod_1.z.number().int().min(6).optional(),
+    require_lowercase: zod_1.z.boolean().optional(),
+    require_uppercase: zod_1.z.boolean().optional(),
+    require_numbers: zod_1.z.boolean().optional(),
+    require_symbols: zod_1.z.boolean().optional(),
+    temporary_password_validity_days: zod_1.z.number().int().min(1).optional(),
+    // Accept doc-style keys too (mapped internally).
+    minLength: zod_1.z.number().int().min(6).optional(),
+    requireLowercase: zod_1.z.boolean().optional(),
+    requireUppercase: zod_1.z.boolean().optional(),
+    requireNumbers: zod_1.z.boolean().optional(),
+    requireSymbols: zod_1.z.boolean().optional(),
+    temporaryPasswordValidityDays: zod_1.z.number().int().min(1).optional()
+})
+    .optional();
+const CreateUserPoolSchema = zod_1.z.object({
+    account_id: zod_1.z
+        .string()
+        .optional()
+        .describe('Account ID. If omitted, Scaly will infer from your accessible stacks.'),
+    name: zod_1.z.string().min(1).describe('Cognito user pool add-on name'),
+    password_policy: PasswordPolicySchema,
+    mfa: zod_1.z.enum(['off', 'optional', 'required']).optional().default('optional'),
+    preview: zod_1.z.boolean().default(true)
+});
+const CreateAppSchema = zod_1.z.object({
+    account_id: zod_1.z
+        .string()
+        .optional()
+        .describe('Account ID. If omitted, Scaly will infer from the stack.'),
+    stack_id: zod_1.z.string().describe('Stack ID'),
+    name: zod_1.z.string().min(1).describe('App name'),
+    framework: zod_1.z
+        .string()
+        .optional()
+        .describe('Optional framework label (used for guidance; not enforced by API)'),
+    min_idle: zod_1.z.number().int().min(0).optional(),
+    preview: zod_1.z.boolean().default(true)
+});
+const LinkAddOnSchema = zod_1.z.object({
+    app_id: zod_1.z.string().describe('App ID'),
+    addon_id: zod_1.z.string().describe('Add-on ID'),
+    preview: zod_1.z.boolean().default(true)
+});
+const ConfigureAuthSchema = zod_1.z.object({
+    app_id: zod_1.z.string().describe('App ID'),
+    user_pool_id: zod_1.z.string().describe('Cognito add-on ID to use for auth'),
+    groups: zod_1.z
+        .array(zod_1.z.string())
+        .optional()
+        .default([])
+        .describe('Optional list of allowed groups (empty means no group restriction)'),
+    preview: zod_1.z.boolean().default(true)
+});
+function normalizePasswordPolicy(input) {
+    if (!input)
+        return undefined;
+    return {
+        minimumLength: input.minimum_length ?? input.minLength,
+        requireLowercase: input.require_lowercase ?? input.requireLowercase,
+        requireUppercase: input.require_uppercase ?? input.requireUppercase,
+        requireNumbers: input.require_numbers ?? input.requireNumbers,
+        requireSymbols: input.require_symbols ?? input.requireSymbols,
+        temporaryPasswordValidityDays: input.temporary_password_validity_days ??
+            input.temporaryPasswordValidityDays
+    };
+}
+function mfaToSettings(mfa) {
+    if (mfa === 'off')
+        return { enabled: false, required: false };
+    if (mfa === 'optional')
+        return { enabled: true, required: false };
+    return { enabled: true, required: true };
+}
+exports.writeTools = [
+    {
+        name: 'scaly_create_stack',
+        description: 'Create a new stack. Use preview=true first; execute with preview=false.',
+        inputSchema: CreateStackSchema,
+        handler: async (input) => {
+            try {
+                const accountId = await resolveAccountId(input.account_id);
+                if (!accountId) {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: 'account_id is required (unable to infer account from accessible stacks).',
+                        retriable: false
+                    });
+                }
+                const existing = await stackExistsByName(accountId, input.name);
+                if (existing.length) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_EXISTS',
+                        message: `Stack already exists: ${input.name}`,
+                        retriable: false,
+                        details: { matches: existing }
+                    }, { existing: existing[0] });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_create: {
+                            type: 'stack',
+                            name: input.name,
+                            size: input.size,
+                            min_idle: input.min_idle ?? 0,
+                            account_id: accountId
+                        },
+                        estimated_cost: {
+                            monthly_usd: estimateStackMonthlyUsd(input.size)
+                        },
+                        estimated_duration_seconds: 30,
+                        notes: input.region
+                            ? [
+                                'region is derived from account today; region is informational only'
+                            ]
+                            : []
+                    });
+                }
+                const gql = `
+          mutation CreateStack($data: StackCreateInput!) {
+            createStack(data: $data) { id name accountId size minIdle status }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    data: {
+                        name: input.name,
+                        size: input.size,
+                        minIdle: input.min_idle ?? 0,
+                        account: { connect: { id: accountId } }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    stack: result.createStack
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_update_stack',
+        description: 'Update stack settings (size/min_idle). Use preview=true first; execute with preview=false.',
+        inputSchema: UpdateStackSchema,
+        handler: async (input) => {
+            try {
+                const existing = await getStackById(input.stack_id);
+                if (!existing) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `Stack not found: ${input.stack_id}`,
+                        retriable: false
+                    });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_update: {
+                            stack_id: input.stack_id,
+                            stack_name: existing.name,
+                            changes: {
+                                size: input.size,
+                                min_idle: input.min_idle
+                            }
+                        }
+                    });
+                }
+                const gql = `
+          mutation UpdateStack($where: StackWhereUniqueInput!, $data: StackUpdateInput) {
+            updateStack(where: $where, data: $data) { id name accountId size minIdle status }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    where: { id: input.stack_id },
+                    data: {
+                        size: input.size,
+                        minIdle: typeof input.min_idle === 'number' ? input.min_idle : undefined
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    stack: result.updateStack
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_delete_stack',
+        description: 'Delete a stack. Use preview=true first. When ready, set preview=false and confirm=true.',
+        inputSchema: DeleteStackSchema,
+        handler: async (input) => {
+            try {
+                const existing = await getStackById(input.stack_id);
+                if (!existing) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `Stack not found: ${input.stack_id}`,
+                        retriable: false
+                    });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_delete: {
+                            type: 'stack',
+                            stack_id: input.stack_id,
+                            stack_name: existing.name
+                        },
+                        warning: 'Deleting a stack is destructive. Ensure apps are removed or migrated first.'
+                    });
+                }
+                if (!input.confirm) {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: 'confirm must be true to delete a stack.',
+                        retriable: false
+                    });
+                }
+                const gql = `
+          mutation DeleteStack($where: StackWhereUniqueInput!) {
+            deleteStack(where: $where) { id name }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    where: { id: input.stack_id }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    deleted: result.deleteStack
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_create_database',
+        description: 'Create a managed database add-on (Postgres/MySQL). Use preview=true first; execute with preview=false.',
+        inputSchema: CreateDatabaseSchema,
+        handler: async (input) => {
+            try {
+                const accountId = await resolveAccountId(input.account_id);
+                if (!accountId) {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: 'account_id is required (unable to infer account from accessible stacks).',
+                        retriable: false
+                    });
+                }
+                const existing = await addOnExistsByName(accountId, input.name);
+                if (existing.length) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_EXISTS',
+                        message: `Add-on already exists: ${input.name}`,
+                        retriable: false,
+                        details: { matches: existing }
+                    }, { existing: existing[0] });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_create: {
+                            type: 'database',
+                            name: input.name,
+                            engine: input.engine,
+                            size: input.size,
+                            account_id: accountId
+                        },
+                        estimated_cost: { monthly_usd: estimateDbMonthlyUsd(input.size) },
+                        estimated_duration_seconds: 150
+                    });
+                }
+                const gql = `
+          mutation CreateAddOn($data: AddOnCreateInput!) {
+            createAddOn(data: $data) {
+              id
+              name
+              type
+              accountId
+              status
+              addOnDatabase { size type }
+            }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    data: {
+                        type: 'DATABASE',
+                        name: input.name,
+                        account: { connect: { id: accountId } },
+                        addOnDatabase: {
+                            create: {
+                                size: input.size,
+                                type: input.engine
+                            }
+                        }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    addon: result.createAddOn
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_create_storage',
+        description: 'Create an S3 storage add-on. Use preview=true first; execute with preview=false.',
+        inputSchema: CreateStorageSchema,
+        handler: async (input) => {
+            try {
+                const accountId = await resolveAccountId(input.account_id);
+                if (!accountId) {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: 'account_id is required (unable to infer account from accessible stacks).',
+                        retriable: false
+                    });
+                }
+                const existing = await addOnExistsByName(accountId, input.name);
+                if (existing.length) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_EXISTS',
+                        message: `Add-on already exists: ${input.name}`,
+                        retriable: false,
+                        details: { matches: existing }
+                    }, { existing: existing[0] });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_create: {
+                            type: 'storage',
+                            name: input.name,
+                            account_id: accountId
+                        },
+                        estimated_cost: { monthly_usd: 0 },
+                        notes: ['Storage is billed by usage (GB-month + requests).']
+                    });
+                }
+                const gql = `
+          mutation CreateAddOn($data: AddOnCreateInput!) {
+            createAddOn(data: $data) {
+              id
+              name
+              type
+              accountId
+              status
+              addOnStorageS3 { bucket }
+            }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    data: {
+                        type: 'STORAGE_S3',
+                        name: input.name,
+                        account: { connect: { id: accountId } }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    addon: result.createAddOn
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_create_user_pool',
+        description: 'Create a Cognito user pool add-on. Use preview=true first; execute with preview=false. ' +
+            'Note: userPoolName is derived from add-on name; password policy defaults to AWS defaults if omitted.',
+        inputSchema: CreateUserPoolSchema,
+        handler: async (input) => {
+            try {
+                const accountId = await resolveAccountId(input.account_id);
+                if (!accountId) {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: 'account_id is required (unable to infer account from accessible stacks).',
+                        retriable: false
+                    });
+                }
+                const existing = await addOnExistsByName(accountId, input.name);
+                if (existing.length) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_EXISTS',
+                        message: `Add-on already exists: ${input.name}`,
+                        retriable: false,
+                        details: { matches: existing }
+                    }, { existing: existing[0] });
+                }
+                const policy = normalizePasswordPolicy(input.password_policy);
+                const mfa = mfaToSettings(input.mfa);
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_create: {
+                            type: 'cognito',
+                            name: input.name,
+                            account_id: accountId,
+                            password_policy: policy,
+                            mfa
+                        },
+                        estimated_cost: { monthly_usd: 0 },
+                        notes: ['Cognito is billed by MAU; estimates depend on usage.']
+                    });
+                }
+                const gql = `
+          mutation CreateAddOn($data: AddOnCreateInput!) {
+            createAddOn(data: $data) {
+              id
+              name
+              type
+              accountId
+              status
+              addOnCognito { userPoolName userPoolId }
+            }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    data: {
+                        type: 'COGNITO',
+                        name: input.name,
+                        account: { connect: { id: accountId } },
+                        addOnCognito: {
+                            create: {
+                                passwordPolicy: policy,
+                                mfa
+                            }
+                        }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    addon: result.createAddOn
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_create_app',
+        description: 'Create an app on a stack. Use preview=true first; execute with preview=false.',
+        inputSchema: CreateAppSchema,
+        handler: async (input) => {
+            try {
+                // Infer account from stack.
+                const stackRes = await (0, client_js_1.query)(`
+            query GetStack($where: StackWhereUniqueInput!) {
+              getStack(where: $where) { id name accountId }
+            }
+          `, { where: { id: input.stack_id } });
+                const stack = stackRes.getStack;
+                if (!stack) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `Stack not found: ${input.stack_id}`,
+                        retriable: false
+                    });
+                }
+                const accountId = input.account_id || stack.accountId;
+                const existing = await appExistsByName(accountId, input.name);
+                if (existing.length) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_EXISTS',
+                        message: `App already exists: ${input.name}`,
+                        retriable: false,
+                        details: { matches: existing }
+                    }, { existing: existing[0] });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_create: {
+                            type: 'app',
+                            name: input.name,
+                            framework: input.framework ?? null,
+                            stack_id: input.stack_id,
+                            stack_name: stack.name,
+                            account_id: accountId,
+                            min_idle: input.min_idle ?? 0
+                        },
+                        notes: input.framework
+                            ? [
+                                'framework is used for guidance/detection; API does not enforce it'
+                            ]
+                            : []
+                    });
+                }
+                const gql = `
+          mutation CreateApp($data: AppCreateInput!) {
+            createApp(data: $data) {
+              id
+              name
+              accountId
+              stackId
+              status
+              minIdle
+              createdAt
+              updatedAt
+            }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    data: {
+                        name: input.name,
+                        minIdle: input.min_idle ?? 0,
+                        account: { connect: { id: accountId } },
+                        stack: { connect: { id: input.stack_id } }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    app: result.createApp
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_link_addon',
+        description: 'Link an add-on to an app (connect relationship). Use preview=true first; execute with preview=false.',
+        inputSchema: LinkAddOnSchema,
+        handler: async (input) => {
+            try {
+                const app = await getAppById(input.app_id);
+                if (!app) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `App not found: ${input.app_id}`,
+                        retriable: false
+                    });
+                }
+                const addon = await getAddOnById(input.addon_id);
+                if (!addon) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `Add-on not found: ${input.addon_id}`,
+                        retriable: false
+                    });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_link: {
+                            app: { id: app.id, name: app.name },
+                            addon: { id: addon.id, name: addon.name, type: addon.type }
+                        }
+                    });
+                }
+                const gql = `
+          mutation UpdateApp($where: AppWhereUniqueInput!, $data: AppUpdateInput) {
+            updateApp(where: $where, data: $data) { id name }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    where: { id: input.app_id },
+                    data: {
+                        addOns: {
+                            connect: [{ id: input.addon_id }]
+                        }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    linked: true,
+                    app: result.updateApp
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    },
+    {
+        name: 'scaly_configure_auth',
+        description: 'Configure app auth by linking a Cognito user pool add-on to the app and setting allowed groups. Use preview=true first; execute with preview=false.',
+        inputSchema: ConfigureAuthSchema,
+        handler: async (input) => {
+            try {
+                const app = await getAppById(input.app_id);
+                if (!app) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `App not found: ${input.app_id}`,
+                        retriable: false
+                    });
+                }
+                const addon = await getAddOnById(input.user_pool_id);
+                if (!addon) {
+                    return (0, index_js_1.fail)({
+                        code: 'RESOURCE_NOT_FOUND',
+                        message: `Add-on not found: ${input.user_pool_id}`,
+                        retriable: false
+                    });
+                }
+                if (addon.type !== 'COGNITO') {
+                    return (0, index_js_1.fail)({
+                        code: 'VALIDATION_ERROR',
+                        message: `Add-on ${input.user_pool_id} is type ${addon.type}; expected COGNITO.`,
+                        retriable: false,
+                        details: { addon }
+                    });
+                }
+                if (input.preview) {
+                    return (0, index_js_1.ok)({
+                        preview: true,
+                        drift_warning: true,
+                        would_configure_auth: {
+                            app: { id: app.id, name: app.name },
+                            user_pool: { id: addon.id, name: addon.name, type: addon.type },
+                            groups: input.groups
+                        }
+                    });
+                }
+                const gql = `
+          mutation UpdateApp($where: AppWhereUniqueInput!, $data: AppUpdateInput) {
+            updateApp(where: $where, data: $data) { id name }
+          }
+        `;
+                const result = await (0, client_js_1.query)(gql, {
+                    where: { id: input.app_id },
+                    data: {
+                        addOns: { connect: [{ id: input.user_pool_id }] },
+                        auth: { upsert: { groups: input.groups } }
+                    }
+                });
+                return (0, index_js_1.ok)({
+                    preview: false,
+                    drift_warning: true,
+                    configured: true,
+                    app: result.updateApp,
+                    groups: input.groups
+                });
+            }
+            catch (err) {
+                return (0, index_js_1.fail)({
+                    code: 'INTERNAL_ERROR',
+                    message: err.message,
+                    retriable: true
+                });
+            }
+        }
+    }
+];
+//# sourceMappingURL=write.js.map