@oscharko-dev/keiko 0.2.0-beta.7 → 0.2.0-beta.9

package/node_modules/@oscharko-dev/keiko-server/dist/gateway-setup.js

@@ -9,7 +9,10 @@ import { apiKeyHeaderValue, ConfigInvalidError, DEFAULT_API_KEY_HEADER_NAME, Gat
 import { gatewayFetch, readJsonCapped } from "@oscharko-dev/keiko-model-gateway/internal/http";
 import { redact } from "@oscharko-dev/keiko-security";
 import { errorBody } from "./routes.js";
-import { currentGatewayEgressConfig } from "./deps.js";
+import { currentGatewayConfig, currentGatewayEgressConfig } from "./deps.js";
+import { CONVERSATION_SYSTEM_PROMPT } from "./conversation-prompt.js";
+import { classifyFigmaTransportError, FigmaConnectorError, } from "./qualityIntelligence/figma/figmaConnectorErrors.js";
+import { classifyTokenFailure } from "./qualityIntelligence/figma/figmaTokenSource.js";
 const MAX_BODY_BYTES = 64_000;
 // Issue #144: exported so discovery-normalization tests can pin the slice cap
 // without hardcoding the number. The discovery surface is a public seam.
@@ -18,6 +21,8 @@ const MAX_DEPLOYMENT_NAMES = 100;
 const MAX_MODEL_ID_LENGTH = 160;
 const DISCOVERED_MODEL_SMOKE_TIMEOUT_MS = 15_000;
 const DEPLOYMENT_SMOKE_TIMEOUT_MS = 30_000;
+const FIGMA_CREDENTIAL_SMOKE_TIMEOUT_MS = 15_000;
+const FIGMA_CREDENTIAL_SMOKE_RESPONSE_BYTES = 64_000;
 const SETUP_SMOKE_CONCURRENCY = 4;
 const CHAT_COMPATIBLE_MODES = new Set(["chat", "completion", "responses"]);
 const EMBEDDING_ID_PATTERN = /(?:^|[-_/. ])(?:text-)?embed(?:ding)?s?(?:[-_/. ]|$)|ada-002(?:$|[-_/. ])/i;
@@ -72,12 +77,16 @@ function candidateBaseUrls(baseUrl) {
     try {
         const url = new URL(primary);
         if (url.hostname.endsWith(".services.ai.azure.com")) {
+            const openAiV1 = `${url.origin}/openai/v1`;
             if (url.pathname === "" || url.pathname === "/") {
                 candidates.push(`${url.origin}/openai/v1`);
             }
             else if (primary.endsWith("/openai")) {
                 candidates.push(`${primary}/v1`);
             }
+            else if (primary !== openAiV1 && !primary.endsWith("/openai/v1")) {
+                candidates.push(openAiV1);
+            }
         }
         else if (!primary.endsWith("/v1")) {
             candidates.push(`${primary}/v1`);
@@ -113,7 +122,7 @@ function providerRaw(modelId, baseUrl, apiKey, options = {}) {
             : defaultCapability,
         timeoutMs: options.timeoutMs ?? 30_000,
         maxRetries: options.maxRetries ?? 2,
-        retryBaseDelayMs: 500,
+        retryBaseDelayMs: options.retryBaseDelayMs ?? 500,
     };
 }
 function isLikelyEmbeddingModelId(modelId) {
@@ -161,6 +170,32 @@ function buildRawConfig(baseUrl, apiKey, modelIds, options = {}) {
         circuitBreaker: { failureThreshold: 5, cooldownMs: 30_000, halfOpenProbes: 2 },
     };
 }
+function currentImageInputModelIds(config) {
+    return (config?.capabilities
+        ?.filter((capability) => capability.kind === "chat" && capability.supportsImageInput)
+        .map((capability) => capability.id) ?? []);
+}
+function rawConfigFromCurrent(config, figmaAccessToken) {
+    return {
+        providers: config.providers.map((provider) => {
+            const capability = config.capabilities?.find((item) => item.id === provider.modelId);
+            return {
+                modelId: provider.modelId,
+                baseUrl: provider.baseUrl,
+                apiKey: provider.apiKey,
+                apiKeyHeaderName: provider.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME,
+                timeoutMs: provider.timeoutMs,
+                maxRetries: provider.maxRetries,
+                retryBaseDelayMs: provider.retryBaseDelayMs,
+                ...(capability === undefined ? {} : { capability }),
+            };
+        }),
+        circuitBreaker: config.circuitBreaker,
+        ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
+        ...(config.grounding === undefined ? {} : { grounding: config.grounding }),
+        ...(figmaAccessToken === undefined ? {} : { figma: { accessToken: figmaAccessToken } }),
+    };
+}
 function withInheritedEgress(rawConfig, egress) {
     if (egress === undefined || Object.hasOwn(rawConfig, "egress")) {
         return rawConfig;
@@ -420,10 +455,53 @@ async function defaultGatewaySetupTester(config, candidateModelIds) {
     return smokeTestCandidates(candidateModelIds, async (modelId) => {
         await gateway.chat({
             modelId,
-            messages: [{ role: "user", content: "Reply with exactly: OK" }],
+            messages: [
+                { role: "system", content: CONVERSATION_SYSTEM_PROMPT },
+                { role: "user", content: "Reply with exactly: OK" },
+            ],
         });
     }, SETUP_SMOKE_CONCURRENCY);
 }
+const FIGMA_ME_ENDPOINT = "https://api.figma.com/v1/me";
+function figmaReason(body) {
+    if (!isRecord(body))
+        return undefined;
+    const reason = body.err ?? body.message;
+    return typeof reason === "string" ? reason : undefined;
+}
+async function defaultFigmaCredentialTester(accessToken, egress) {
+    try {
+        const response = await gatewayFetch(FIGMA_ME_ENDPOINT, {
+            method: "GET",
+            headers: {
+                Accept: "application/json",
+                "X-Figma-Token": accessToken,
+            },
+            redirect: "manual",
+            signal: AbortSignal.timeout(FIGMA_CREDENTIAL_SMOKE_TIMEOUT_MS),
+            ...(egress !== undefined ? { egress } : {}),
+        });
+        let body;
+        try {
+            body = await readJsonCapped(response, FIGMA_CREDENTIAL_SMOKE_RESPONSE_BYTES);
+        }
+        catch {
+            throw new FigmaConnectorError("FIGMA_RESPONSE_TOO_LARGE");
+        }
+        if (!response.ok) {
+            throw classifyTokenFailure(response.status, figmaReason(body));
+        }
+        if (!isRecord(body)) {
+            throw new FigmaConnectorError("FIGMA_INTERNAL");
+        }
+    }
+    catch (error) {
+        if (error instanceof FigmaConnectorError) {
+            throw error;
+        }
+        throw new FigmaConnectorError(classifyFigmaTransportError(error));
+    }
+}
 function savePrivateJson(path, raw) {
     const resolvedPath = resolve(path);
     const dir = dirname(resolvedPath);
@@ -498,39 +576,111 @@ function readSetupModelLists(raw) {
     }
     return { deploymentNames, imageInputModelIds };
 }
-function readSetupRequest(raw, env) {
-    if (!isRecord(raw)) {
-        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
+function optionalSetupSecret(value, path) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        return { status: 400, body: errorBody("BAD_REQUEST", `${path} must be a string.`) };
+    }
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function hasNonBlankStringField(raw, key) {
+    const value = raw[key];
+    return typeof value === "string" && value.trim().length > 0;
+}
+function hasNonEmptyListField(raw, key) {
+    const value = raw[key];
+    if (typeof value === "string") {
+        return normalizeDeploymentNames(deploymentNameValues(value) ?? []).length > 0;
+    }
+    return Array.isArray(value) && value.some((item) => typeof item === "string" && item.trim());
+}
+function shouldPreserveExisting(raw, current) {
+    return raw.preserveExisting === true && current !== undefined;
+}
+function firstProvider(current) {
+    return current?.providers[0];
+}
+function trimmedSubmittedString(raw, key) {
+    const value = raw[key];
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length === 0 ? undefined : trimmed;
+}
+function submittedOrInheritedString(raw, key, inherited, preserveExisting) {
+    return trimmedSubmittedString(raw, key) ?? (preserveExisting ? (inherited ?? "") : "");
+}
+function setupApiKeyHeaderSource(raw, provider, preserveExisting) {
+    if (raw.apiKeyHeaderName !== undefined || !preserveExisting) {
+        return raw.apiKeyHeaderName;
     }
-    const baseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl.trim() : "";
-    const apiKey = typeof raw.apiKey === "string" ? raw.apiKey.trim() : "";
+    return provider?.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME;
+}
+function readSetupGatewayCredentials(raw, env, current, preserveExisting) {
+    const provider = firstProvider(current);
+    const baseUrl = submittedOrInheritedString(raw, "baseUrl", provider?.baseUrl, preserveExisting);
+    const apiKey = submittedOrInheritedString(raw, "apiKey", provider?.apiKey, preserveExisting);
     if (baseUrl.length === 0 || apiKey.length === 0) {
         return { status: 400, body: errorBody("BAD_REQUEST", "baseUrl and apiKey are required.") };
     }
-    const apiKeyHeaderName = normalizeSetupApiKeyHeaderName(raw.apiKeyHeaderName);
+    const apiKeyHeaderSource = setupApiKeyHeaderSource(raw, provider, preserveExisting);
+    const apiKeyHeaderName = normalizeSetupApiKeyHeaderName(apiKeyHeaderSource);
     if (isRouteResult(apiKeyHeaderName)) {
         return apiKeyHeaderName;
     }
+    const invalidConnection = validateSetupConnection(baseUrl, apiKey, apiKeyHeaderName, env);
+    if (invalidConnection !== undefined) {
+        return invalidConnection;
+    }
+    return { baseUrl, apiKey, apiKeyHeaderName };
+}
+function resolveSetupModelLists(modelLists, current, preserveExisting) {
+    const existing = preserveExisting ? current : undefined;
+    return {
+        deploymentNames: existing !== undefined && modelLists.deploymentNames.length === 0
+            ? existing.providers.map((item) => item.modelId)
+            : modelLists.deploymentNames,
+        imageInputModelIds: existing !== undefined && modelLists.imageInputModelIds.length === 0
+            ? currentImageInputModelIds(existing)
+            : modelLists.imageInputModelIds,
+    };
+}
+function setupRequiresGatewayVerification(raw, preserveExisting) {
+    return (!preserveExisting ||
+        hasNonBlankStringField(raw, "baseUrl") ||
+        hasNonBlankStringField(raw, "apiKey") ||
+        hasNonBlankStringField(raw, "apiKeyHeaderName") ||
+        hasNonEmptyListField(raw, "deploymentNames") ||
+        hasNonEmptyListField(raw, "imageInputModelIds"));
+}
+function readSetupRequest(raw, env, current) {
+    if (!isRecord(raw)) {
+        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
+    }
+    const preserveExisting = shouldPreserveExisting(raw, current);
+    const credentials = readSetupGatewayCredentials(raw, env, current, preserveExisting);
+    if (isRouteResult(credentials)) {
+        return credentials;
+    }
     const modelLists = readSetupModelLists(raw);
     if (isRouteResult(modelLists)) {
         return modelLists;
     }
-    if (Object.hasOwn(raw, "figmaAccessToken")) {
-        return {
-            status: 400,
-            body: errorBody("BAD_REQUEST", "Figma access tokens must be configured server-side, not through gateway setup."),
-        };
-    }
-    const invalidConnection = validateSetupConnection(baseUrl, apiKey, apiKeyHeaderName, env);
-    if (invalidConnection !== undefined) {
-        return invalidConnection;
+    const figmaAccessToken = optionalSetupSecret(raw.figmaAccessToken, "figmaAccessToken");
+    if (isRouteResult(figmaAccessToken)) {
+        return figmaAccessToken;
     }
+    const resolvedModelLists = resolveSetupModelLists(modelLists, current, preserveExisting);
     return {
-        baseUrl,
-        apiKey,
-        apiKeyHeaderName,
-        deploymentNames: modelLists.deploymentNames,
-        imageInputModelIds: modelLists.imageInputModelIds,
+        ...credentials,
+        deploymentNames: resolvedModelLists.deploymentNames,
+        imageInputModelIds: resolvedModelLists.imageInputModelIds,
+        figmaAccessToken: figmaAccessToken ?? current?.figma?.accessToken,
+        verifyGateway: setupRequiresGatewayVerification(raw, preserveExisting),
+        verifyFigmaCredential: figmaAccessToken !== undefined,
     };
 }
 function safeError(error, secrets) {
@@ -548,39 +698,72 @@ function assertImageInputModelsWereTested(imageInputModelIds, testedModelIds) {
         throw new Error("imageInputModelIds must match tested chat-callable model ids.");
     }
 }
-async function verifySetupCandidate(baseUrl, apiKey, apiKeyHeaderName, deploymentNames, imageInputModelIds, tester, discovery, env, egress) {
+function validationConfigForSetup(input) {
+    const validationRawConfig = buildRawConfig(input.baseUrl, input.apiKey, ["setup-validation"], {
+        apiKeyHeaderName: input.apiKeyHeaderName,
+        imageInputModelIds: input.imageInputModelIds,
+    });
+    return parseGatewayConfig(withInheritedEgress(validationRawConfig, input.egress), input.env);
+}
+async function candidateModelIdsForSetup(input, validationConfig) {
+    return input.deploymentNames.length > 0
+        ? input.deploymentNames
+        : input.discovery(input.baseUrl, input.apiKey, input.apiKeyHeaderName, validationConfig.egress);
+}
+function finalRawConfigForSetup(input, testedModelIds) {
+    const embeddingModelIds = embeddingModelIdsFromDeployments(input.deploymentNames);
+    const configuredModelIds = mergeChatAndEmbeddingModelIds(testedModelIds, input.deploymentNames);
+    const rawConfig = buildRawConfig(input.baseUrl, input.apiKey, configuredModelIds, {
+        apiKeyHeaderName: input.apiKeyHeaderName,
+        imageInputModelIds: input.imageInputModelIds,
+        embeddingModelIds,
+    });
+    return {
+        ...rawConfig,
+        ...(input.current?.grounding === undefined ? {} : { grounding: input.current.grounding }),
+        ...(input.figmaAccessToken === undefined
+            ? {}
+            : { figma: { accessToken: input.figmaAccessToken } }),
+    };
+}
+function skippedModelIdsForSetup(candidateModelIds, testedModelIds, deploymentNames) {
+    const acceptedModelIds = new Set([
+        ...testedModelIds,
+        ...embeddingModelIdsFromDeployments(deploymentNames),
+    ]);
+    return candidateModelIds.filter((modelId) => !acceptedModelIds.has(modelId));
+}
+async function verifySetupCandidate(input) {
     // Defence-in-depth: never send the credential to a candidate URL that has not passed the same
     // scheme/credential/loopback validation as the originally submitted base URL.
-    validateBaseUrl(baseUrl, "candidate");
-    const validationRawConfig = buildRawConfig(baseUrl, apiKey, ["setup-validation"], {
-        apiKeyHeaderName,
-        imageInputModelIds,
-    });
-    const validationConfig = parseGatewayConfig(withInheritedEgress(validationRawConfig, egress), env);
-    const candidateModelIds = deploymentNames.length > 0
-        ? deploymentNames
-        : await discovery(baseUrl, apiKey, apiKeyHeaderName, validationConfig.egress);
-    const smokeTimeoutMs = deploymentNames.length > 0 ? DEPLOYMENT_SMOKE_TIMEOUT_MS : DISCOVERED_MODEL_SMOKE_TIMEOUT_MS;
-    const candidateRawConfig = buildRawConfig(baseUrl, apiKey, candidateModelIds, {
-        apiKeyHeaderName,
+    validateBaseUrl(input.baseUrl, "candidate");
+    const validationConfig = validationConfigForSetup(input);
+    const candidateModelIds = await candidateModelIdsForSetup(input, validationConfig);
+    const smokeTimeoutMs = input.deploymentNames.length > 0
+        ? DEPLOYMENT_SMOKE_TIMEOUT_MS
+        : DISCOVERED_MODEL_SMOKE_TIMEOUT_MS;
+    const candidateRawConfig = buildRawConfig(input.baseUrl, input.apiKey, candidateModelIds, {
+        apiKeyHeaderName: input.apiKeyHeaderName,
         timeoutMs: smokeTimeoutMs,
-        maxRetries: 0,
-        imageInputModelIds,
-    });
-    const candidateConfig = parseGatewayConfig(withInheritedEgress(candidateRawConfig, egress), env);
-    const testedModelIds = await tester(candidateConfig, candidateModelIds);
-    assertImageInputModelsWereTested(imageInputModelIds, testedModelIds);
-    const embeddingModelIds = embeddingModelIdsFromDeployments(deploymentNames);
-    const configuredModelIds = mergeChatAndEmbeddingModelIds(testedModelIds, deploymentNames);
-    const rawConfig = buildRawConfig(baseUrl, apiKey, configuredModelIds, {
-        apiKeyHeaderName,
-        imageInputModelIds,
-        embeddingModelIds,
+        // One retry (not zero) so a single transient blip — 429 rate-limit, brief timeout, momentary
+        // content-filter — does not permanently exclude an otherwise-working model from the setup and
+        // brand it to the user as incompatible. Still bounded so setup latency stays predictable.
+        maxRetries: 1,
+        imageInputModelIds: input.imageInputModelIds,
     });
-    const config = parseGatewayConfig(withInheritedEgress(rawConfig, egress), env);
-    return { rawConfig, config, testedModelIds };
+    const candidateConfig = parseGatewayConfig(withInheritedEgress(candidateRawConfig, input.egress), input.env);
+    const testedModelIds = await input.tester(candidateConfig, candidateModelIds);
+    assertImageInputModelsWereTested(input.imageInputModelIds, testedModelIds);
+    const rawConfigWithOptionalBlocks = finalRawConfigForSetup(input, testedModelIds);
+    const config = parseGatewayConfig(withInheritedEgress(rawConfigWithOptionalBlocks, input.egress), input.env);
+    return {
+        rawConfig: rawConfigWithOptionalBlocks,
+        config,
+        testedModelIds,
+        skippedModelIds: skippedModelIdsForSetup(candidateModelIds, testedModelIds, input.deploymentNames),
+    };
 }
-function setupSuccessResult(config, testedModelIds) {
+function setupSuccessResult(config, testedModelIds, skippedModelIds) {
     const testedModelId = testedModelIds[0] ?? "unknown";
     return {
         status: 200,
@@ -588,6 +771,7 @@ function setupSuccessResult(config, testedModelIds) {
             ok: true,
             testedModelId,
             testedModelIds,
+            skippedModelIds,
             providerCount: config.providers.length,
             models: listConfiguredCapabilities(config),
             config: toSafeObject(config),
@@ -600,6 +784,45 @@ function setupFailureResult(errors) {
         body: errorBody("GATEWAY_SETUP_FAILED", `Credentials could not be verified. ${errors.join(" ")}`),
     };
 }
+function figmaFailureStatus(code) {
+    switch (code) {
+        case "FIGMA_TOKEN_INVALID":
+        case "FIGMA_TOKEN_EXPIRED":
+        case "FIGMA_TOKEN_REVOKED":
+        case "FIGMA_INSUFFICIENT_SCOPE":
+        case "FIGMA_CONSENT_REQUIRED":
+            return 400;
+        case "FIGMA_RATE_LIMITED":
+            return 429;
+        default:
+            return 502;
+    }
+}
+function figmaCredentialFailureResult(error, request) {
+    if (error instanceof FigmaConnectorError) {
+        return {
+            status: figmaFailureStatus(error.code),
+            body: errorBody(error.code, error.message),
+        };
+    }
+    return {
+        status: 502,
+        body: errorBody("FIGMA_EGRESS_FAILED", safeError(error, [request.figmaAccessToken, request.apiKey, request.baseUrl])),
+    };
+}
+async function verifySubmittedFigmaCredential(request, deps) {
+    if (!request.verifyFigmaCredential || request.figmaAccessToken === undefined) {
+        return undefined;
+    }
+    const tester = deps.figmaCredentialTester ?? defaultFigmaCredentialTester;
+    try {
+        await tester(request.figmaAccessToken, currentGatewayEgressConfig(deps));
+        return undefined;
+    }
+    catch (error) {
+        return figmaCredentialFailureResult(error, request);
+    }
+}
 function deploymentNamesRequiredResult() {
     return {
         status: 400,
@@ -633,39 +856,60 @@ function gatewayUnavailableResult() {
         body: errorBody("GATEWAY_SETUP_UNAVAILABLE", "Gateway setup is unavailable."),
     };
 }
-async function trySetupCandidate(baseUrl, request, deps, gatewayConfig, tester, discovery) {
-    const verified = await verifySetupCandidate(baseUrl, request.apiKey, request.apiKeyHeaderName, request.deploymentNames, request.imageInputModelIds, tester, discovery, deps.env, currentGatewayEgressConfig(deps));
+async function trySetupCandidate(baseUrl, request, deps, gatewayConfig, tester, discovery, current) {
+    const verified = await verifySetupCandidate({
+        baseUrl,
+        apiKey: request.apiKey,
+        apiKeyHeaderName: request.apiKeyHeaderName,
+        deploymentNames: request.deploymentNames,
+        imageInputModelIds: request.imageInputModelIds,
+        tester,
+        discovery,
+        env: deps.env,
+        egress: currentGatewayEgressConfig(deps),
+        figmaAccessToken: request.figmaAccessToken,
+        current,
+    });
     savePrivateJson(gatewayConfig.storagePath, verified.rawConfig);
     gatewayConfig.set(verified.config, true);
-    return setupSuccessResult(verified.config, verified.testedModelIds);
+    return setupSuccessResult(verified.config, verified.testedModelIds, verified.skippedModelIds);
 }
 function setupCandidateError(error, request, baseUrl) {
-    return safeError(error, [request.apiKey, request.baseUrl, baseUrl]);
+    return safeError(error, [request.apiKey, request.baseUrl, baseUrl, request.figmaAccessToken]);
 }
-export async function handleGatewaySetup(ctx, deps) {
-    if (deps.gatewayConfig === undefined) {
-        return gatewayUnavailableResult();
-    }
-    const { gatewayConfig } = deps;
-    const bodyResult = await readJsonSetupBody(ctx);
-    if ("status" in bodyResult) {
-        return bodyResult;
-    }
-    const request = readSetupRequest(bodyResult.parsed, deps.env);
-    if ("status" in request) {
-        return request;
+function saveExistingConfigUpdate(request, current, deps, gatewayConfig) {
+    const rawConfig = rawConfigFromCurrent(current, request.figmaAccessToken);
+    const config = parseGatewayConfig(withInheritedEgress(rawConfig, currentGatewayEgressConfig(deps)), deps.env);
+    savePrivateJson(gatewayConfig.storagePath, rawConfig);
+    gatewayConfig.set(config, true);
+    return setupSuccessResult(config, config.providers.map((provider) => provider.modelId), []);
+}
+async function verifyAndSaveExistingConfigUpdate(request, current, deps, gatewayConfig) {
+    const figmaFailure = await verifySubmittedFigmaCredential(request, deps);
+    if (figmaFailure !== undefined) {
+        return figmaFailure;
     }
+    return saveExistingConfigUpdate(request, current, deps, gatewayConfig);
+}
+function shouldRequireDeploymentNames(request, baseUrlCandidates) {
+    return (request.deploymentNames.length === 0 &&
+        baseUrlCandidates.some((baseUrl) => isAzureFoundryBaseUrl(baseUrl)));
+}
+async function verifyAndSaveGatewaySetup(request, current, deps, gatewayConfig) {
     const tester = deps.gatewaySetupTester ?? defaultGatewaySetupTester;
     const discovery = deps.gatewayModelDiscovery ?? defaultGatewayModelDiscovery;
+    const figmaFailure = await verifySubmittedFigmaCredential(request, deps);
+    if (figmaFailure !== undefined) {
+        return figmaFailure;
+    }
     const baseUrlCandidates = candidateBaseUrls(request.baseUrl);
-    if (request.deploymentNames.length === 0 &&
-        baseUrlCandidates.some((baseUrl) => isAzureFoundryBaseUrl(baseUrl))) {
+    if (shouldRequireDeploymentNames(request, baseUrlCandidates)) {
         return deploymentNamesRequiredResult();
     }
     const errors = [];
     for (const baseUrl of baseUrlCandidates) {
         try {
-            return await trySetupCandidate(baseUrl, request, deps, gatewayConfig, tester, discovery);
+            return await trySetupCandidate(baseUrl, request, deps, gatewayConfig, tester, discovery, current);
         }
         catch (error) {
             errors.push(`candidate ${String(errors.length + 1)}: ${setupCandidateError(error, request, baseUrl)}`);
@@ -673,3 +917,22 @@ export async function handleGatewaySetup(ctx, deps) {
     }
     return setupFailureResult(errors);
 }
+export async function handleGatewaySetup(ctx, deps) {
+    if (deps.gatewayConfig === undefined) {
+        return gatewayUnavailableResult();
+    }
+    const { gatewayConfig } = deps;
+    const current = currentGatewayConfig(deps);
+    const bodyResult = await readJsonSetupBody(ctx);
+    if ("status" in bodyResult) {
+        return bodyResult;
+    }
+    const request = readSetupRequest(bodyResult.parsed, deps.env, current);
+    if ("status" in request) {
+        return request;
+    }
+    if (!request.verifyGateway && current !== undefined) {
+        return verifyAndSaveExistingConfigUpdate(request, current, deps, gatewayConfig);
+    }
+    return verifyAndSaveGatewaySetup(request, current, deps, gatewayConfig);
+}

package/node_modules/@oscharko-dev/keiko-server/dist/grounded-orchestrator.d.ts

@@ -36,6 +36,7 @@ export declare class ClarificationNeededError extends Error {
     constructor(clarification: ClarificationPrompt);
 }
 export declare function clarificationUserMessage(error: ClarificationNeededError): string;
+export declare function isSymbolDefinitionPath(scopePath: string, term: string): boolean;
 export declare function retrieveConnectedContextPack(input: OrchestratorInput, deps: OrchestratorDeps): Promise<RetrievalOnlyOutput>;
 export declare function runGroundedExploration(input: OrchestratorInput, deps: OrchestratorDeps): Promise<OrchestratorOutput>;
 export { DEFAULT_SEARCH_LIMITS };

package/node_modules/@oscharko-dev/keiko-server/dist/grounded-orchestrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grounded-orchestrator.d.ts","sourceRoot":"","sources":["../src/grounded-orchestrator.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,iBAAiB,EAGtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EASL,KAAK,mBAAmB,EAExB,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EAarB,KAAK,WAAW,EAChB,KAAK,aAAa,EAGnB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAAkC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlG,MAAM,WAAW,gBAAgB;IAG/B,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAE1B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,KAAK,aAAa,CAAC;IAE5E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IAEtD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAMD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAKD,qBAAa,wBAAyB,SAAQ,KAAK;aACd,aAAa,EAAE,mBAAmB;gBAAlC,aAAa,EAAE,mBAAmB;CAItE;AAMD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AAmwCD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAoC9B;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAID,OAAO,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"grounded-orchestrator.d.ts","sourceRoot":"","sources":["../src/grounded-orchestrator.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,oBAAoB,EAEzB,KAAK,iBAAiB,EAGtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAUL,KAAK,mBAAmB,EAExB,KAAK,eAAe,EAEpB,KAAK,UAAU,EAIhB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EAerB,KAAK,WAAW,EAChB,KAAK,aAAa,EAGnB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAAkC,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIlG,MAAM,WAAW,gBAAgB;IAG/B,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAE1C,QAAQ,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;IAE1B,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,KAAK,aAAa,CAAC;IAE5E,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IAEtD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;CACjC;AAMD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAKD,qBAAa,wBAAyB,SAAQ,KAAK;aACd,aAAa,EAAE,mBAAmB;gBAAlC,aAAa,EAAE,mBAAmB;CAItE;AAMD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAgBhF;AA25BD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAM/E;AA20BD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA8B7B;AAID,OAAO,EAAE,qBAAqB,EAAE,CAAC"}