edgegate-mcp 0.4.1 → 0.8.0

package/dist/tools/invite_member.js

@@ -0,0 +1,85 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const inviteMemberInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    user_email: z
+        .string()
+        .email()
+        .describe("Email of an existing EdgeGate user to add. The user must already have " +
+        "an EdgeGate account — this tool does NOT send invitation emails to " +
+        "external addresses (v1 only attaches existing users)."),
+    role: z
+        .enum(["owner", "admin", "viewer"])
+        .describe("Their role in this workspace. `owner` = full control including billing " +
+        "and member management; `admin` = can manage pipelines and runs but not " +
+        "billing or delete the workspace; `viewer` = read-only."),
+});
+export async function inviteMemberHandler(client, input) {
+    try {
+        const member = await client.addMember(input.workspace_id, {
+            user_email: input.user_email,
+            role: input.role,
+        });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `Added **${member.email}** to this workspace as **${member.role}**.`,
+                        ``,
+                        `- user_id: \`${member.user_id}\``,
+                        ``,
+                        `They can now sign in and access the workspace at their permission level. Change their role with \`edgegate_change_member_role\` or remove them with \`edgegate_remove_member\`.`,
+                    ].join("\n"),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 404) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `No EdgeGate user with email \`${input.user_email}\` found.\n\n` +
+                                `EdgeGate v1 only adds existing users — they need to register at ` +
+                                `https://edgegate.frozo.ai/register first, then re-run this tool.`,
+                        },
+                    ],
+                };
+            }
+            if (err.status === 409) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `\`${input.user_email}\` is already a member of this workspace. Use \`edgegate_change_member_role\` to update their role.`,
+                        },
+                    ],
+                };
+            }
+            if (err.status === 403) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Add-member blocked: ${err.detail}\n\n` +
+                                `Common causes: only owners can add other owners, or the workspace seat limit is reached. ` +
+                                `Upgrade at https://edgegate.frozo.ai/pricing if it's a plan limit.`,
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=invite_member.js.map

package/dist/tools/invite_member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite_member.js","sourceRoot":"","sources":["../../src/tools/invite_member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,KAAK,EAAE;SACP,QAAQ,CACP,wEAAwE;QACtE,qEAAqE;QACrE,uDAAuD,CAC1D;IACH,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;SAClC,QAAQ,CACP,yEAAyE;QACvE,yEAAyE;QACzE,wDAAwD,CAC3D;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAwB;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE;YACxD,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,WAAW,MAAM,CAAC,KAAK,6BAA6B,MAAM,CAAC,IAAI,KAAK;wBACpE,EAAE;wBACF,gBAAgB,MAAM,CAAC,OAAO,IAAI;wBAClC,EAAE;wBACF,iLAAiL;qBAClL,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,iCAAiC,KAAK,CAAC,UAAU,eAAe;gCAChE,kEAAkE;gCAClE,kEAAkE;yBACrE;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,KAAK,KAAK,CAAC,UAAU,qGAAqG;yBACjI;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,uBAAuB,GAAG,CAAC,MAAM,MAAM;gCACvC,2FAA2F;gCAC3F,oEAAoE;yBACvE;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/tools/list_api_keys.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const listApiKeysInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+}, {
+    workspace_id: string;
+}>;
+export type ListApiKeysInput = z.infer<typeof listApiKeysInputSchema>;
+export declare function listApiKeysHandler(client: EdgeGateClient, input: ListApiKeysInput): Promise<ToolResult>;

package/dist/tools/list_api_keys.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const listApiKeysInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+});
+export async function listApiKeysHandler(client, input) {
+    try {
+        const keys = await client.listApiKeys(input.workspace_id);
+        if (keys.length === 0) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: "No API keys in this workspace yet. Create one with `edgegate_create_api_key`.",
+                    },
+                ],
+            };
+        }
+        return {
+            content: [{ type: "text", text: formatTable(keys) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+function formatTable(keys) {
+    const lines = [
+        `Found ${keys.length} API key${keys.length === 1 ? "" : "s"} in this workspace:`,
+        ``,
+        `| name | id | prefix...suffix | status | last used |`,
+        `|---|---|---|---|---|`,
+    ];
+    for (const k of keys) {
+        const status = k.revoked_at
+            ? "revoked"
+            : k.expires_at && new Date(k.expires_at) < new Date()
+                ? "expired"
+                : "active";
+        lines.push(`| ${k.name} | \`${k.id}\` | \`${k.prefix}...${k.suffix}\` | ${status} | ${k.last_used_at ?? "never"} |`);
+    }
+    lines.push(``, `Revoke a key with \`edgegate_revoke_api_key({ workspace_id, key_id })\`. The plaintext is never recoverable — if it was lost, rotate by creating a new key and revoking the old.`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=list_api_keys.js.map

package/dist/tools/list_api_keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_api_keys.js","sourceRoot":"","sources":["../../src/tools/list_api_keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,KAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,+EAA+E;qBACtF;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB;IACzC,MAAM,KAAK,GAAa;QACtB,SAAS,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;QAChF,EAAE;QACF,sDAAsD;QACtD,uBAAuB;KACxB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,EAAE;gBACnD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,QAAQ,CAAC;QACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,QAAQ,MAAM,MAAM,CAAC,CAAC,YAAY,IAAI,OAAO,IAAI,CACzG,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,kLAAkL,CACnL,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/list_members.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const listMembersInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+}, {
+    workspace_id: string;
+}>;
+export type ListMembersInput = z.infer<typeof listMembersInputSchema>;
+export declare function listMembersHandler(client: EdgeGateClient, input: ListMembersInput): Promise<ToolResult>;

package/dist/tools/list_members.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const listMembersInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+});
+export async function listMembersHandler(client, input) {
+    try {
+        const members = await client.listMembers(input.workspace_id);
+        if (members.length === 0) {
+            return {
+                content: [
+                    { type: "text", text: "No members in this workspace yet (which should be impossible — the owner is always a member)." },
+                ],
+            };
+        }
+        return {
+            content: [{ type: "text", text: formatTable(members) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+function formatTable(members) {
+    const lines = [
+        `Found ${members.length} member${members.length === 1 ? "" : "s"} in this workspace:`,
+        ``,
+        `| email | role | user_id |`,
+        `|---|---|---|`,
+    ];
+    for (const m of members) {
+        lines.push(`| ${m.email} | ${m.role} | \`${m.user_id}\` |`);
+    }
+    lines.push(``, `Invite with \`edgegate_invite_member\`, change role with \`edgegate_change_member_role\`, remove with \`edgegate_remove_member\`. Roles: \`owner\` (full control), \`admin\` (manage pipelines + runs, can't change billing or delete workspace), \`viewer\` (read-only).`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=list_members.js.map

package/dist/tools/list_members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list_members.js","sourceRoot":"","sources":["../../src/tools/list_members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAsB,EACtB,KAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+FAA+F,EAAE;iBACxH;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;SACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAiB;IACpC,MAAM,KAAK,GAAa;QACtB,SAAS,OAAO,CAAC,MAAM,UAAU,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qBAAqB;QACrF,EAAE;QACF,4BAA4B;QAC5B,eAAe;KAChB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,2QAA2Q,CAC5Q,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/register_byo_artifact.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const registerByoArtifactInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    s3_uri: z.ZodString;
+    expected_sha256: z.ZodOptional<z.ZodString>;
+    expected_size: z.ZodOptional<z.ZodNumber>;
+    kind: z.ZodOptional<z.ZodString>;
+    original_filename: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+    s3_uri: string;
+    expected_sha256?: string | undefined;
+    expected_size?: number | undefined;
+    kind?: string | undefined;
+    original_filename?: string | undefined;
+}, {
+    workspace_id: string;
+    s3_uri: string;
+    expected_sha256?: string | undefined;
+    expected_size?: number | undefined;
+    kind?: string | undefined;
+    original_filename?: string | undefined;
+}>;
+export type RegisterByoArtifactInput = z.infer<typeof registerByoArtifactInputSchema>;
+export declare function registerByoArtifactHandler(client: EdgeGateClient, input: RegisterByoArtifactInput): Promise<ToolResult>;

package/dist/tools/register_byo_artifact.js

@@ -0,0 +1,122 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const registerByoArtifactInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    s3_uri: z
+        .string()
+        .regex(/^s3:\/\/[a-z0-9][a-z0-9\-.]{1,253}\/.+$/)
+        .describe("Full S3 URI of the object in your registered bucket, e.g. " +
+        "s3://my-bucket/models/mobilenet-v2.onnx. Must live in the same " +
+        "bucket the grant was registered with."),
+    expected_sha256: z
+        .string()
+        .regex(/^[a-f0-9]{64}$/)
+        .optional()
+        .describe("Optional SHA-256 of the object (hex). If supplied, downstream cells " +
+        "will fail with BYO_INTEGRITY_MISMATCH when the actual bytes don't " +
+        "match — a strong guarantee that you ran what you thought you ran."),
+    expected_size: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Optional size in bytes. EdgeGate cross-checks against the HeadObject " +
+        "response and rejects the registration if they disagree — protects " +
+        "against stale pointers when an object was overwritten in S3."),
+    kind: z
+        .string()
+        .optional()
+        .describe("Artifact kind. Defaults to 'model'."),
+    original_filename: z
+        .string()
+        .optional()
+        .describe("Optional display filename for run reports."),
+});
+export async function registerByoArtifactHandler(client, input) {
+    try {
+        const artifact = await client.registerByoArtifact(input.workspace_id, {
+            s3_uri: input.s3_uri,
+            expected_sha256: input.expected_sha256,
+            expected_size: input.expected_size,
+            kind: input.kind,
+            original_filename: input.original_filename,
+        });
+        return renderArtifact(artifact);
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 402) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `BYO storage requires the Enterprise plan. ` +
+                                `Contact sales: https://edgegate.frozo.ai/enterprise.`,
+                        },
+                    ],
+                };
+            }
+            if (err.status === 400) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: [
+                                `EdgeGate rejected the BYO artifact registration:`,
+                                ``,
+                                `\`${err.detail}\``,
+                                ``,
+                                `Most common causes:`,
+                                `- **No active grant** — register one with \`edgegate_register_byo_bucket\` first.`,
+                                `- **Bucket mismatch** — the s3_uri's bucket is not the one this workspace ` +
+                                    `registered. Cross-bucket pointers are not allowed.`,
+                                `- **BYO_OBJECT_NOT_FOUND** — the s3_uri's key doesn't exist in the bucket. ` +
+                                    `Double-check the path; HeadObject is case-sensitive.`,
+                                `- **BYO_OBJECT_ACCESS_DENIED** — the IAM role lacks \`s3:GetObject\` ` +
+                                    `on this specific key (a bucket-policy or resource-condition denial).`,
+                                `- **Size mismatch** — the \`expected_size\` you supplied doesn't match the ` +
+                                    `actual object. Drop it (or update it) and retry.`,
+                            ].join("\n"),
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [
+                    { type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` },
+                ],
+            };
+        }
+        throw err;
+    }
+}
+function renderArtifact(artifact) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: [
+                    `Registered BYO artifact — bytes never left your AWS account.`,
+                    ``,
+                    `- artifact_id: \`${artifact.id}\``,
+                    `- storage: \`${artifact.storage_url}\``,
+                    `- kind: ${artifact.kind}`,
+                    `- size: ${artifact.size_bytes.toLocaleString()} bytes`,
+                    `- sha256: \`${artifact.sha256}\``,
+                    artifact.original_filename
+                        ? `- filename: \`${artifact.original_filename}\``
+                        : `- filename: (none)`,
+                    ``,
+                    `Pass this \`artifact_id\` to \`edgegate_create_pipeline\` (in \`model_matrix\`) ` +
+                        `or \`edgegate_run_gate\` (as \`model_artifact_id\`) to run it. ` +
+                        `When a cell needs the model, EdgeGate's worker will AssumeRole into your ` +
+                        `account and GetObject directly from S3.`,
+                ].join("\n"),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=register_byo_artifact.js.map

package/dist/tools/register_byo_artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register_byo_artifact.js","sourceRoot":"","sources":["../../src/tools/register_byo_artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,yCAAyC,CAAC;SAChD,QAAQ,CACP,4DAA4D;QAC1D,iEAAiE;QACjE,uCAAuC,CAC1C;IACH,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,CAAC;SACvB,QAAQ,EAAE;SACV,QAAQ,CACP,sEAAsE;QACpE,oEAAoE;QACpE,mEAAmE,CACtE;IACH,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE;QACrE,oEAAoE;QACpE,8DAA8D,CACjE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;CAC1D,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAsB,EACtB,KAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE;YACpE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,4CAA4C;gCAC5C,sDAAsD;yBACzD;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,kDAAkD;gCAClD,EAAE;gCACF,KAAK,GAAG,CAAC,MAAM,IAAI;gCACnB,EAAE;gCACF,qBAAqB;gCACrB,mFAAmF;gCACnF,4EAA4E;oCAC1E,oDAAoD;gCACtD,6EAA6E;oCAC3E,sDAAsD;gCACxD,uEAAuE;oCACrE,sEAAsE;gCACxE,6EAA6E;oCAC3E,kDAAkD;6BACrD,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE;iBACzE;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAA0B;IAChD,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,8DAA8D;oBAC9D,EAAE;oBACF,oBAAoB,QAAQ,CAAC,EAAE,IAAI;oBACnC,gBAAgB,QAAQ,CAAC,WAAW,IAAI;oBACxC,WAAW,QAAQ,CAAC,IAAI,EAAE;oBAC1B,WAAW,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ;oBACvD,eAAe,QAAQ,CAAC,MAAM,IAAI;oBAClC,QAAQ,CAAC,iBAAiB;wBACxB,CAAC,CAAC,iBAAiB,QAAQ,CAAC,iBAAiB,IAAI;wBACjD,CAAC,CAAC,oBAAoB;oBACxB,EAAE;oBACF,kFAAkF;wBAChF,iEAAiE;wBACjE,2EAA2E;wBAC3E,yCAAyC;iBAC5C,CAAC,IAAI,CAAC,IAAI,CAAC;aACb;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/register_byo_bucket.d.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const registerByoBucketInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    role_arn: z.ZodString;
+    bucket: z.ZodString;
+    region: z.ZodString;
+    kms_key_id: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+    role_arn: string;
+    bucket: string;
+    region: string;
+    kms_key_id?: string | undefined;
+}, {
+    workspace_id: string;
+    role_arn: string;
+    bucket: string;
+    region: string;
+    kms_key_id?: string | undefined;
+}>;
+export type RegisterByoBucketInput = z.infer<typeof registerByoBucketInputSchema>;
+export declare function registerByoBucketHandler(client: EdgeGateClient, input: RegisterByoBucketInput): Promise<ToolResult>;

package/dist/tools/register_byo_bucket.js

@@ -0,0 +1,143 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const registerByoBucketInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    role_arn: z
+        .string()
+        .regex(/^arn:aws:iam::\d{12}:role\/.+$/)
+        .describe("ARN of the IAM role EdgeGate's workers will assume to read your bucket. " +
+        "Created by the EdgeGate CloudFormation launch stack (or your equivalent " +
+        "Terraform module). Format: arn:aws:iam::<account-id>:role/<name>."),
+    bucket: z
+        .string()
+        .min(3)
+        .max(255)
+        .regex(/^[a-z0-9][a-z0-9\-.]{1,253}$/)
+        .describe("S3 bucket name (not the URI — just the bucket name)."),
+    region: z
+        .string()
+        .min(4)
+        .max(64)
+        .describe("AWS region the bucket lives in, e.g. us-east-1."),
+    kms_key_id: z
+        .string()
+        .max(2048)
+        .optional()
+        .describe("Optional KMS key ARN if the bucket uses SSE-KMS. The IAM role must " +
+        "have kms:Decrypt on this key."),
+});
+export async function registerByoBucketHandler(client, input) {
+    try {
+        const grant = await client.registerByoGrant(input.workspace_id, {
+            role_arn: input.role_arn,
+            bucket: input.bucket,
+            region: input.region,
+            kms_key_id: input.kms_key_id,
+        });
+        return successText(grant);
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 402) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: [
+                                `BYO storage requires the **Enterprise plan**.`,
+                                ``,
+                                `Reach out to sales at https://edgegate.frozo.ai/enterprise ` +
+                                    `to enable BYO storage on this workspace. ` +
+                                    `Once enabled, re-run \`edgegate_register_byo_bucket\` with the ` +
+                                    `same role + bucket details.`,
+                            ].join("\n"),
+                        },
+                    ],
+                };
+            }
+            if (err.status === 409) {
+                // Do NOT auto-rotate — the existing grant may belong to a different
+                // role_arn the customer doesn't want overwritten by accident.
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: [
+                                `This workspace already has a BYO storage grant registered.`,
+                                ``,
+                                `Two safe paths forward:`,
+                                `1. Inspect the existing grant with \`edgegate_check_byo_bucket\` ` +
+                                    `to confirm it's the one you intended.`,
+                                `2. If you want to replace it: \`edgegate_disconnect_byo_bucket\` ` +
+                                    `first (will 409 if artifacts still reference it), then re-run ` +
+                                    `\`edgegate_register_byo_bucket\` with the new role/bucket.`,
+                                ``,
+                                `External-ID rotation (without replacing the grant) is available ` +
+                                    `via the dashboard at ` +
+                                    `https://edgegate.frozo.ai/workspace/${input.workspace_id}/settings#byo-storage.`,
+                            ].join("\n"),
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [
+                    {
+                        type: "text",
+                        text: `EdgeGate returned ${err.status}: ${err.detail}`,
+                    },
+                ],
+            };
+        }
+        throw err;
+    }
+}
+function roleArnTail(roleArn) {
+    // arn:aws:iam::123456789012:role/edgegate-byo-storage-prod
+    // Render the trailing role name + last 4 of the account id so the user can
+    // confirm at a glance that they registered the right role.
+    const parts = roleArn.split(":");
+    if (parts.length < 6)
+        return roleArn;
+    const account = parts[4];
+    const roleName = parts.slice(5).join(":").replace(/^role\//, "");
+    const acctTail = account.length > 4 ? `…${account.slice(-4)}` : account;
+    return `${roleName} (acct ${acctTail})`;
+}
+function successText(grant) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: [
+                    `Registered BYO storage grant for this workspace.`,
+                    ``,
+                    `- role: \`${roleArnTail(grant.role_arn)}\``,
+                    `- bucket: \`${grant.bucket}\` (${grant.region})`,
+                    grant.kms_key_id
+                        ? `- kms key: \`${grant.kms_key_id}\``
+                        : `- kms key: (none — SSE-S3 or no encryption)`,
+                    `- status: **${grant.status}**`,
+                    `- external_id: \`${grant.external_id}\``,
+                    ``,
+                    `**Action required if you haven't already:** add this External ID to ` +
+                        `your IAM role's trust policy under \`Condition.StringEquals.sts:ExternalId\`. ` +
+                        `Without it, AssumeRole will fail with BYO_ASSUME_ROLE_FAILED.`,
+                    ``,
+                    grant.status === "active"
+                        ? `The readiness probe just passed. You can register your first artifact ` +
+                            `with \`edgegate_register_byo_artifact\`.`
+                        : grant.last_verify_error
+                            ? `The readiness probe FAILED: \`${grant.last_verify_error}\`. Fix the ` +
+                                `IAM/bucket/KMS configuration, then re-probe with ` +
+                                `\`edgegate_check_byo_bucket\`.`
+                            : `Probe outcome pending — run \`edgegate_check_byo_bucket\` to verify.`,
+                ].join("\n"),
+            },
+        ],
+    };
+}
+//# sourceMappingURL=register_byo_bucket.js.map

package/dist/tools/register_byo_bucket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register_byo_bucket.js","sourceRoot":"","sources":["../../src/tools/register_byo_bucket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,gCAAgC,CAAC;SACvC,QAAQ,CACP,0EAA0E;QACxE,0EAA0E;QAC1E,mEAAmE,CACtE;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,8BAA8B,CAAC;SACrC,QAAQ,CAAC,sDAAsD,CAAC;IACnE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,qEAAqE;QACnE,+BAA+B,CAClC;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAsB,EACtB,KAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE;YAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,+CAA+C;gCAC/C,EAAE;gCACF,6DAA6D;oCAC3D,2CAA2C;oCAC3C,iEAAiE;oCACjE,6BAA6B;6BAChC,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,oEAAoE;gBACpE,8DAA8D;gBAC9D,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE;gCACJ,4DAA4D;gCAC5D,EAAE;gCACF,yBAAyB;gCACzB,mEAAmE;oCACjE,uCAAuC;gCACzC,mEAAmE;oCACjE,gEAAgE;oCAChE,4DAA4D;gCAC9D,EAAE;gCACF,kEAAkE;oCAChE,uBAAuB;oCACvB,uCAAuC,KAAK,CAAC,YAAY,wBAAwB;6BACpF,CAAC,IAAI,CAAC,IAAI,CAAC;yBACb;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE;qBACvD;iBACF;aACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,2DAA2D;IAC3D,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,OAAO,GAAG,QAAQ,UAAU,QAAQ,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE;oBACJ,kDAAkD;oBAClD,EAAE;oBACF,aAAa,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;oBAC5C,eAAe,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,GAAG;oBACjD,KAAK,CAAC,UAAU;wBACd,CAAC,CAAC,gBAAgB,KAAK,CAAC,UAAU,IAAI;wBACtC,CAAC,CAAC,6CAA6C;oBACjD,eAAe,KAAK,CAAC,MAAM,IAAI;oBAC/B,oBAAoB,KAAK,CAAC,WAAW,IAAI;oBACzC,EAAE;oBACF,sEAAsE;wBACpE,gFAAgF;wBAChF,+DAA+D;oBACjE,EAAE;oBACF,KAAK,CAAC,MAAM,KAAK,QAAQ;wBACvB,CAAC,CAAC,wEAAwE;4BACxE,0CAA0C;wBAC5C,CAAC,CAAC,KAAK,CAAC,iBAAiB;4BACvB,CAAC,CAAC,iCAAiC,KAAK,CAAC,iBAAiB,cAAc;gCACtE,mDAAmD;gCACnD,gCAAgC;4BAClC,CAAC,CAAC,sEAAsE;iBAC7E,CAAC,IAAI,CAAC,IAAI,CAAC;aACb;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/remove_member.d.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { EdgeGateClient } from "../client.js";
+import type { ToolResult } from "./setup_workspace.js";
+export declare const removeMemberInputSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    user_id: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    workspace_id: string;
+    user_id: string;
+}, {
+    workspace_id: string;
+    user_id: string;
+}>;
+export type RemoveMemberInput = z.infer<typeof removeMemberInputSchema>;
+export declare function removeMemberHandler(client: EdgeGateClient, input: RemoveMemberInput): Promise<ToolResult>;

package/dist/tools/remove_member.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { EdgeGateError } from "../client.js";
+export const removeMemberInputSchema = z.object({
+    workspace_id: z.string().uuid(),
+    user_id: z
+        .string()
+        .uuid()
+        .describe("Target member's user_id (from `edgegate_list_members`). The user immediately " +
+        "loses access to the workspace. Their pipelines and runs are preserved — " +
+        "this only removes the membership row."),
+});
+export async function removeMemberHandler(client, input) {
+    try {
+        await client.removeMember(input.workspace_id, input.user_id);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: [
+                        `Removed user \`${input.user_id}\` from this workspace.`,
+                        ``,
+                        `Pipelines and runs they created are preserved. Re-invite any time with \`edgegate_invite_member\` if it was a mistake.`,
+                    ].join("\n"),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        if (err instanceof EdgeGateError) {
+            if (err.status === 400) {
+                // Most likely "Cannot remove the last owner from workspace".
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `Member removal rejected: ${err.detail}\n\n` +
+                                `If you're trying to remove the last owner, promote another member ` +
+                                `to owner first via \`edgegate_change_member_role\`, then remove ` +
+                                `the original owner.`,
+                        },
+                    ],
+                };
+            }
+            if (err.status === 404) {
+                return {
+                    isError: true,
+                    content: [
+                        {
+                            type: "text",
+                            text: `User \`${input.user_id}\` is not a member of this workspace.`,
+                        },
+                    ],
+                };
+            }
+            return {
+                isError: true,
+                content: [{ type: "text", text: `EdgeGate returned ${err.status}: ${err.detail}` }],
+            };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=remove_member.js.map

package/dist/tools/remove_member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove_member.js","sourceRoot":"","sources":["../../src/tools/remove_member.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,IAAI,EAAE;SACN,QAAQ,CACP,+EAA+E;QAC7E,0EAA0E;QAC1E,uCAAuC,CAC1C;CACJ,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,KAAwB;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE;wBACJ,kBAAkB,KAAK,CAAC,OAAO,yBAAyB;wBACxD,EAAE;wBACF,wHAAwH;qBACzH,CAAC,IAAI,CAAC,IAAI,CAAC;iBACb;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,6DAA6D;gBAC7D,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,4BAA4B,GAAG,CAAC,MAAM,MAAM;gCAC5C,oEAAoE;gCACpE,kEAAkE;gCAClE,qBAAqB;yBACxB;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,UAAU,KAAK,CAAC,OAAO,uCAAuC;yBACrE;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;aACpF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}