@superblocksteam/gateway 2.0.0-SNAPSHOT.1d4c72c0ab174c21

package/dist/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../src/deps.ts"],"names":[],"mappings":""}

package/dist/health/readiness.d.ts

@@ -0,0 +1,99 @@
+import type { GatewayFault } from "../process/fault-barrier.js";
+/**
+ * What the gateway's own request path is doing.
+ *
+ * `unmounted` is not a degenerate case: `createApp` builds the HTTP surface
+ * before the MCP transport is mounted onto it, and a gateway in that window has
+ * no way to serve a tool call. Reporting it as healthy is the ENG-5809 bug in
+ * miniature.
+ */
+export type DispatchState = "faulted" | "ok" | "unmounted" | "wedged";
+export type UpstreamState = "reachable" | "unknown" | "unreachable";
+export type ReadinessVerdict = {
+    dispatch: DispatchState;
+    /** Human-readable cause, present only when something is wrong. */
+    detail?: string;
+    /** Whether callers should be routed here. */
+    ready: boolean;
+    upstream: UpstreamState;
+};
+/**
+ * Proves the gateway can still take a request all the way through its own
+ * dispatch path. Resolving means it can; throwing or hanging means it cannot.
+ */
+export type DispatchProbe = () => Promise<void>;
+export type UpstreamProbe = () => Promise<UpstreamState>;
+export type GatewayReadinessOptions = {
+    cacheMs?: number;
+    dispatchDeadlineMs?: number;
+    /** Where the cause behind a bounded `detail` goes. */
+    log?: (message: string, cause: unknown) => void;
+    now?: () => number;
+    /** The Superblocks origin this gateway fronts, named in the verdict. */
+    serverUrl: string;
+    upstreamProbe?: UpstreamProbe;
+};
+/**
+ * Probes an origin for reachability rather than for authorization.
+ *
+ * Any HTTP status is a pass, including 401: a server that refuses an
+ * unauthenticated probe has still proved it is answering, which is the only
+ * question a health check can ask without a caller's credential. Only a
+ * transport failure or a timeout means unreachable.
+ */
+export declare function createUpstreamProbe(input: {
+    fetchImpl?: typeof fetch;
+    serverUrl: string;
+    timeoutMs?: number;
+}): UpstreamProbe;
+/**
+ * The gateway's honest answer to "are you working".
+ *
+ * Two questions, deliberately kept apart, because during the ENG-5809 outage
+ * nothing on the wire told the difference:
+ *
+ * - {@link liveness} asks whether *this process* can still serve. It fails on a
+ *   broken or wedged dispatch path and on a fault it decided not to survive.
+ *   An unreachable platform never fails it, because restarting this gateway
+ *   cannot fix the platform, and a supervisor acting on liveness would restart
+ *   a working process every few seconds until the platform came back.
+ * - {@link readiness} asks whether tool calls should be routed here, so an
+ *   unreachable platform does fail it: nothing can be served through it.
+ *
+ * Both report `dispatch` and `upstream` as separate fields either way, so a
+ * caller reads which side to act on instead of inferring it from a bare "ok".
+ */
+export declare class GatewayReadiness {
+    private cached;
+    private dispatchProbe;
+    private fatal;
+    private inFlight;
+    private readonly options;
+    constructor(options: GatewayReadinessOptions);
+    /**
+     * Hands over the real dispatch path, once there is one. Called by the MCP
+     * transport as it mounts; until then the gateway reports `unmounted`.
+     */
+    useDispatchProbe(probe: DispatchProbe): void;
+    /**
+     * Records what the process-level barrier caught.
+     *
+     * Only a fatal fault changes the verdict. A rejection the barrier absorbed
+     * cost one caller their call; failing liveness for it would hand a working
+     * process to a restart loop, which is the outage the barrier prevents.
+     */
+    recordFault(fault: GatewayFault): void;
+    liveness(): Promise<ReadinessVerdict>;
+    readiness(): Promise<ReadinessVerdict>;
+    private verdict;
+    /**
+     * One probe run per cache window, shared by however many pollers arrive
+     * while it is running. Eight concurrent agents polling health must not stack
+     * eight MCP servers onto a gateway that is already struggling.
+     */
+    private probe;
+    private runProbe;
+    private probeDispatch;
+    private log;
+    private probeUpstream;
+}

package/dist/health/readiness.js

@@ -0,0 +1,202 @@
+import { recordReadinessVerdict } from "../telemetry/metrics.js";
+/** How long the dispatch path gets to answer before it counts as wedged. */
+const DEFAULT_DISPATCH_DEADLINE_MS = 5_000;
+/** How long the upstream origin gets to answer before it counts as down. */
+const DEFAULT_UPSTREAM_DEADLINE_MS = 3_000;
+/** How long one probe run answers for. Health endpoints get polled hard. */
+const DEFAULT_CACHE_MS = 2_000;
+async function withDeadline(work, deadlineMs, onDeadline) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(onDeadline()), deadlineMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        if (timer) {
+            clearTimeout(timer);
+        }
+    }
+}
+/**
+ * Probes an origin for reachability rather than for authorization.
+ *
+ * Any HTTP status is a pass, including 401: a server that refuses an
+ * unauthenticated probe has still proved it is answering, which is the only
+ * question a health check can ask without a caller's credential. Only a
+ * transport failure or a timeout means unreachable.
+ */
+export function createUpstreamProbe(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    return async () => {
+        try {
+            await fetchImpl(input.serverUrl, {
+                method: "GET",
+                signal: AbortSignal.timeout(input.timeoutMs ?? DEFAULT_UPSTREAM_DEADLINE_MS),
+            });
+            return "reachable";
+        }
+        catch {
+            return "unreachable";
+        }
+    };
+}
+/**
+ * The gateway's honest answer to "are you working".
+ *
+ * Two questions, deliberately kept apart, because during the ENG-5809 outage
+ * nothing on the wire told the difference:
+ *
+ * - {@link liveness} asks whether *this process* can still serve. It fails on a
+ *   broken or wedged dispatch path and on a fault it decided not to survive.
+ *   An unreachable platform never fails it, because restarting this gateway
+ *   cannot fix the platform, and a supervisor acting on liveness would restart
+ *   a working process every few seconds until the platform came back.
+ * - {@link readiness} asks whether tool calls should be routed here, so an
+ *   unreachable platform does fail it: nothing can be served through it.
+ *
+ * Both report `dispatch` and `upstream` as separate fields either way, so a
+ * caller reads which side to act on instead of inferring it from a bare "ok".
+ */
+export class GatewayReadiness {
+    cached;
+    dispatchProbe;
+    fatal;
+    inFlight;
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Hands over the real dispatch path, once there is one. Called by the MCP
+     * transport as it mounts; until then the gateway reports `unmounted`.
+     */
+    useDispatchProbe(probe) {
+        this.dispatchProbe = probe;
+    }
+    /**
+     * Records what the process-level barrier caught.
+     *
+     * Only a fatal fault changes the verdict. A rejection the barrier absorbed
+     * cost one caller their call; failing liveness for it would hand a working
+     * process to a restart loop, which is the outage the barrier prevents.
+     */
+    recordFault(fault) {
+        if (fault.fatal) {
+            this.fatal = fault;
+        }
+    }
+    async liveness() {
+        return this.verdict("liveness");
+    }
+    async readiness() {
+        return this.verdict("readiness");
+    }
+    async verdict(probe) {
+        const probed = await this.probe();
+        const upstreamCounts = probe === "readiness";
+        const upstreamDown = upstreamCounts && probed.upstream === "unreachable";
+        const verdict = {
+            dispatch: probed.dispatch,
+            ready: probed.dispatch === "ok" && !upstreamDown,
+            upstream: probed.upstream,
+            ...detailOf(probed, upstreamDown, this.options.serverUrl),
+        };
+        recordReadinessVerdict({
+            dispatch: verdict.dispatch,
+            probe,
+            ready: verdict.ready,
+            upstream: verdict.upstream,
+        });
+        return verdict;
+    }
+    /**
+     * One probe run per cache window, shared by however many pollers arrive
+     * while it is running. Eight concurrent agents polling health must not stack
+     * eight MCP servers onto a gateway that is already struggling.
+     */
+    async probe() {
+        const now = (this.options.now ?? Date.now)();
+        const cacheMs = this.options.cacheMs ?? DEFAULT_CACHE_MS;
+        if (this.cached && now - this.cached.at < cacheMs) {
+            return this.cached;
+        }
+        this.inFlight ??= this.runProbe(now).finally(() => {
+            this.inFlight = undefined;
+        });
+        return this.inFlight;
+    }
+    async runProbe(at) {
+        const [dispatch, upstream] = await Promise.all([
+            this.probeDispatch(),
+            this.probeUpstream(),
+        ]);
+        const probed = { at, upstream, ...dispatch };
+        this.cached = probed;
+        return probed;
+    }
+    async probeDispatch() {
+        // A fault the process did not survive outranks anything a probe could say:
+        // the heap it left behind is what the probe would be running on.
+        if (this.fatal) {
+            // The kind and not the message. Both probes are unauthenticated, and an
+            // exception message can carry an internal route, a query, or an id that
+            // a caller cannot act on anyway. The message went to the log when the
+            // barrier caught it.
+            return {
+                dispatch: "faulted",
+                dispatchDetail: `The gateway recorded a fatal ${this.fatal.kind} and is waiting to be restarted.`,
+            };
+        }
+        const probe = this.dispatchProbe;
+        if (!probe) {
+            return {
+                dispatch: "unmounted",
+                dispatchDetail: "No MCP transport is mounted on this gateway yet.",
+            };
+        }
+        const deadlineMs = this.options.dispatchDeadlineMs ?? DEFAULT_DISPATCH_DEADLINE_MS;
+        try {
+            return await withDeadline(probe().then(() => ({ dispatch: "ok" })), deadlineMs, () => ({
+                dispatch: "wedged",
+                dispatchDetail: `The gateway's own dispatch path did not answer within ${deadlineMs}ms.`,
+            }));
+        }
+        catch (error) {
+            // Same reason as the fatal branch: the cause is for the operator reading
+            // logs, not for an unauthenticated caller reading a health endpoint.
+            this.log("gateway dispatch probe failed", error);
+            return {
+                dispatch: "wedged",
+                dispatchDetail: "The gateway's own dispatch path failed.",
+            };
+        }
+    }
+    log(message, cause) {
+        (this.options.log ?? ((text, err) => console.error(text, err)))(message, cause);
+    }
+    async probeUpstream() {
+        const probe = this.options.upstreamProbe;
+        if (!probe) {
+            return "unknown";
+        }
+        try {
+            return await probe();
+        }
+        catch {
+            return "unreachable";
+        }
+    }
+}
+function detailOf(probed, upstreamDown, serverUrl) {
+    const reasons = [
+        probed.dispatchDetail,
+        upstreamDown ? `${serverUrl} did not answer.` : undefined,
+    ].filter((reason) => reason !== undefined);
+    return reasons.length > 0 ? { detail: reasons.join(" ") } : {};
+}
+//# sourceMappingURL=readiness.js.map

package/dist/health/readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.js","sourceRoot":"","sources":["../../src/health/readiness.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,4EAA4E;AAC5E,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAiD/B,KAAK,UAAU,YAAY,CACzB,IAAgB,EAChB,UAAkB,EAClB,UAAmB;IAEnB,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI;YACJ,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;gBACzB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC5D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC/B,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CACzB,KAAK,CAAC,SAAS,IAAI,4BAA4B,CAChD;aACF,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAqB;IAC3B,aAAa,CAA4B;IACzC,KAAK,CAA2B;IAChC,QAAQ,CAA8B;IAC7B,OAAO,CAA0B;IAElD,YAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,KAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,KAAmB;QAC7B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,KAA+B;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,KAAK,KAAK,WAAW,CAAC;QAC7C,MAAM,YAAY,GAAG,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAC;QACzE,MAAM,OAAO,GAAqB;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY;YAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SAC1D,CAAC;QACF,sBAAsB,CAAC;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK;QACjB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAChD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,EAAU;QAC/B,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,aAAa,EAAE;YACpB,IAAI,CAAC,aAAa,EAAE;SACrB,CAAC,CAAC;QACH,MAAM,MAAM,GAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa;QAIzB,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,qBAAqB;YACrB,OAAO;gBACL,QAAQ,EAAE,SAAS;gBACnB,cAAc,EAAE,gCAAgC,IAAI,CAAC,KAAK,CAAC,IAAI,kCAAkC;aAClG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,QAAQ,EAAE,WAAW;gBACrB,cAAc,EAAE,kDAAkD;aACnE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,4BAA4B,CAAC;QAClE,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CACvB,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC,CAAC,EACjD,UAAU,EACV,GAAG,EAAE,CAAC,CAAC;gBACL,QAAQ,EAAE,QAAiB;gBAC3B,cAAc,EAAE,yDAAyD,UAAU,KAAK;aACzF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YACjD,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,cAAc,EAAE,yCAAyC;aAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,KAAc;QACzC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAC7D,OAAO,EACP,KAAK,CACN,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAED,SAAS,QAAQ,CACf,MAAc,EACd,YAAqB,EACrB,SAAiB;IAEjB,MAAM,OAAO,GAAG;QACd,MAAM,CAAC,cAAc;QACrB,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,kBAAkB,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { loadConfig } from "./config.js";
+export { scanHostBrowserMcp } from "./capture/host-mcp-scan.js";
+export { formatCaptureModeSummary, formatCaptureModeUserSummary, resolveCaptureMode, } from "./capture/mode.js";
+export { editApp, IMPORT_ZIP_MAX_BYTES, previewApp, publishApp, startApp, uploadArtifact, } from "./capabilities/lifecycle.js";
+export { GATEWAY_FAULT_EXIT_CODE } from "./process/fault-barrier.js";
+export { startStdioGateway } from "./start.js";
+export type { StartGatewayOptions, StartedGateway } from "./start.js";
+export { ensurePlaywrightChromium, playwrightChromiumPresent, } from "./playwright/ensure-chromium.js";

package/dist/index.js

@@ -0,0 +1,8 @@
+export { loadConfig } from "./config.js";
+export { scanHostBrowserMcp } from "./capture/host-mcp-scan.js";
+export { formatCaptureModeSummary, formatCaptureModeUserSummary, resolveCaptureMode, } from "./capture/mode.js";
+export { editApp, IMPORT_ZIP_MAX_BYTES, previewApp, publishApp, startApp, uploadArtifact, } from "./capabilities/lifecycle.js";
+export { GATEWAY_FAULT_EXIT_CODE } from "./process/fault-barrier.js";
+export { startStdioGateway } from "./start.js";
+export { ensurePlaywrightChromium, playwrightChromiumPresent, } from "./playwright/ensure-chromium.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC"}

package/dist/integrations/filters.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether Clark's tool surface can use this plugin id.
+ *
+ * Fullstack apps (what Gateway creates) are SDK-enabled, so ad-hoc REST/GraphQL
+ * variants are excluded; preconfigured `restapiintegration` /
+ * `graphqlintegration` stay.
+ */
+export declare function integrationIsToolSupported(pluginId: string, sdkApiEnabled?: boolean): boolean;

package/dist/integrations/filters.js

@@ -0,0 +1,40 @@
+/**
+ * Plugin ids Clark cannot use as tools. Mirrored from the UI's
+ * `integration-filters` so this package does not depend on `packages/ui`.
+ */
+const UNSUPPORTED_INTEGRATION_TYPES = new Set([
+    "confluentkafka",
+    "email",
+    "googlesheets",
+    "kafka",
+    "kinesis",
+    "openai",
+    "redis",
+    "redpanda",
+    "superblocks-ocr",
+    "workflow",
+]);
+/** Ad-hoc types filtered out for SDK-enabled (fullstack) apps. */
+const AD_HOC_INTEGRATION_TYPES = new Set([
+    "graphql",
+    "javascript",
+    "python",
+    "restapi",
+]);
+/**
+ * Whether Clark's tool surface can use this plugin id.
+ *
+ * Fullstack apps (what Gateway creates) are SDK-enabled, so ad-hoc REST/GraphQL
+ * variants are excluded; preconfigured `restapiintegration` /
+ * `graphqlintegration` stay.
+ */
+export function integrationIsToolSupported(pluginId, sdkApiEnabled = true) {
+    if (UNSUPPORTED_INTEGRATION_TYPES.has(pluginId)) {
+        return false;
+    }
+    if (sdkApiEnabled && AD_HOC_INTEGRATION_TYPES.has(pluginId)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=filters.js.map

package/dist/integrations/filters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filters.js","sourceRoot":"","sources":["../../src/integrations/filters.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,gBAAgB;IAChB,OAAO;IACP,cAAc;IACd,OAAO;IACP,SAAS;IACT,QAAQ;IACR,OAAO;IACP,UAAU;IACV,iBAAiB;IACjB,UAAU;CACX,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,aAAa,GAAG,IAAI;IAEpB,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,aAAa,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/integrations/map.d.ts

@@ -0,0 +1,27 @@
+import type { PromptContextIntegration } from "@superblocksteam/library-shared/types";
+/** Minimal fields needed from `GET /api/v1/integrations/superset`. */
+export type SupersetIntegrationRow = {
+    configurations?: Array<{
+        configuration?: {
+            openApiSpecRef?: string;
+        };
+        isDefault?: boolean;
+    }>;
+    id: string;
+    managedBy?: string | null;
+    name: string;
+    permissions?: string[];
+    pluginId: string;
+    readOnly?: boolean;
+};
+export declare function hasBuildPermission(row: SupersetIntegrationRow): boolean;
+/**
+ * Maps a superset row to the shape Clark expects on `aiGetIntegrations`
+ * (no metadata).
+ */
+export declare function toPromptContextIntegrationSummary(row: SupersetIntegrationRow): Omit<PromptContextIntegration, "metadata">;
+/**
+ * BUILD-filtered, tool-supported integrations for Clark's discovery list.
+ */
+export declare function listIntegrationsForClark(rows: SupersetIntegrationRow[], sdkApiEnabled?: boolean): Omit<PromptContextIntegration, "metadata">[];
+export declare function toPromptContextIntegration(row: SupersetIntegrationRow, metadata?: Record<string, unknown>): PromptContextIntegration;

package/dist/integrations/map.js

@@ -0,0 +1,43 @@
+import { integrationIsToolSupported } from "./filters.js";
+export function hasBuildPermission(row) {
+    if (row.permissions && row.permissions.length > 0) {
+        return row.permissions.includes("build");
+    }
+    // Legacy rows without RBAC annotations: BUILD means not read-only.
+    return !row.readOnly;
+}
+function openApiSpecRef(row) {
+    const fromConfig = row.configurations?.find((c) => c.isDefault)?.configuration
+        ?.openApiSpecRef;
+    return fromConfig || undefined;
+}
+/**
+ * Maps a superset row to the shape Clark expects on `aiGetIntegrations`
+ * (no metadata).
+ */
+export function toPromptContextIntegrationSummary(row) {
+    return {
+        displayName: row.name,
+        id: row.id,
+        ...(row.managedBy != null ? { managedBy: row.managedBy } : {}),
+        name: row.name,
+        ...(openApiSpecRef(row) ? { openApiSpecRef: openApiSpecRef(row) } : {}),
+        type: row.pluginId,
+    };
+}
+/**
+ * BUILD-filtered, tool-supported integrations for Clark's discovery list.
+ */
+export function listIntegrationsForClark(rows, sdkApiEnabled = true) {
+    return rows
+        .filter(hasBuildPermission)
+        .filter((row) => integrationIsToolSupported(row.pluginId, sdkApiEnabled))
+        .map(toPromptContextIntegrationSummary);
+}
+export function toPromptContextIntegration(row, metadata = {}) {
+    return {
+        ...toPromptContextIntegrationSummary(row),
+        metadata,
+    };
+}
+//# sourceMappingURL=map.js.map

package/dist/integrations/map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"map.js","sourceRoot":"","sources":["../../src/integrations/map.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAgB1D,MAAM,UAAU,kBAAkB,CAAC,GAA2B;IAC5D,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,mEAAmE;IACnE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,GAA2B;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,aAAa;QAC5E,EAAE,cAAc,CAAC;IACnB,OAAO,UAAU,IAAI,SAAS,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAA2B;IAE3B,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,EAAE,GAAG,CAAC,QAAQ;KACnB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAA8B,EAC9B,aAAa,GAAG,IAAI;IAEpB,OAAO,IAAI;SACR,MAAM,CAAC,kBAAkB,CAAC;SAC1B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;SACxE,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAA2B,EAC3B,WAAoC,EAAE;IAEtC,OAAO;QACL,GAAG,iCAAiC,CAAC,GAAG,CAAC;QACzC,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/integrations/profile-key.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Picks which Superblocks integration profile key Gateway should send to the
+ * orchestrator. Local orgs almost never have a profile literally named
+ * `default` — they use `dev` / `staging` / `production` — and a wrong key
+ * surfaces as orchestrator "Invalid profile specified" / HTTP 500.
+ */
+export type OrgProfileRow = {
+    allowedInEditor?: boolean;
+    key: string;
+};
+/**
+ * Resolves an editor profile key from the org's profile list.
+ *
+ * - Honors `preferred` when it exists on the org (and is not the legacy
+ *   placeholder `default`).
+ * - Otherwise prefers staging → dev → production, then the first listed key.
+ * - When the org list is unavailable, falls back to `preferred` or `staging`.
+ */
+export declare function pickEditorProfileKey(preferred: string | undefined, profiles: OrgProfileRow[]): string;

package/dist/integrations/profile-key.js

@@ -0,0 +1,35 @@
+/**
+ * Picks which Superblocks integration profile key Gateway should send to the
+ * orchestrator. Local orgs almost never have a profile literally named
+ * `default` — they use `dev` / `staging` / `production` — and a wrong key
+ * surfaces as orchestrator "Invalid profile specified" / HTTP 500.
+ */
+const AUTO_PREFERRED_KEYS = ["staging", "dev", "production"];
+/**
+ * Resolves an editor profile key from the org's profile list.
+ *
+ * - Honors `preferred` when it exists on the org (and is not the legacy
+ *   placeholder `default`).
+ * - Otherwise prefers staging → dev → production, then the first listed key.
+ * - When the org list is unavailable, falls back to `preferred` or `staging`.
+ */
+export function pickEditorProfileKey(preferred, profiles) {
+    const configured = preferred?.trim() ?? "";
+    const isAuto = !configured || configured.toLowerCase() === "default";
+    const keys = profiles
+        .map((profile) => profile.key?.trim())
+        .filter((key) => Boolean(key));
+    if (!isAuto && keys.includes(configured)) {
+        return configured;
+    }
+    if (keys.length === 0) {
+        return isAuto ? "staging" : configured;
+    }
+    for (const candidate of AUTO_PREFERRED_KEYS) {
+        if (keys.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return keys[0] ?? "staging";
+}
+//# sourceMappingURL=profile-key.js.map

package/dist/integrations/profile-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-key.js","sourceRoot":"","sources":["../../src/integrations/profile-key.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,mBAAmB,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AAOtE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA6B,EAC7B,QAAyB;IAEzB,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;IACrE,MAAM,IAAI,GAAG,QAAQ;SAClB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;SACrC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACzC,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC9B,CAAC"}

package/dist/integrations/read-only-postgres-query.d.ts

@@ -0,0 +1,2 @@
+export declare function supportsReadOnlyPostgresQuery(pluginId: string): boolean;
+export declare function isReadOnlyPostgresQuery(query: string): Promise<boolean>;