@superblocksteam/gateway 2.0.0-SNAPSHOT.2161f9a02a4eb5d8

package/dist/transports/mcp/instructions/tools/upload-artifact.js

@@ -0,0 +1,13 @@
+export function instructUploadArtifact(result) {
+    if (result.code === "import_zip_too_large") {
+        return "This file is over the 50 MB cap. Ask the user for a smaller export, or (if this is a readable tree already on disk) follow the superblocks-import skill instead of zipping it.";
+    }
+    if (result.code === "import_file_unsupported") {
+        return "Binary content was sent through `files`, which only accepts text. Re-send this file via `filePath` instead - the gateway reads the bytes itself.";
+    }
+    if (result.ok) {
+        return "Pass this result's `artifact` unchanged into `start_app` or `edit_app`'s `artifacts` field. Do not re-upload on a retry - reuse this same artifact.";
+    }
+    return undefined;
+}
+//# sourceMappingURL=upload-artifact.js.map

package/dist/transports/mcp/instructions/tools/upload-artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-artifact.js","sourceRoot":"","sources":["../../../../../src/transports/mcp/instructions/tools/upload-artifact.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC3C,OAAO,gLAAgL,CAAC;IAC1L,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC9C,OAAO,kJAAkJ,CAAC;IAC5J,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,qJAAqJ,CAAC;IAC/J,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/transports/mcp/mcp-app-brand-css.d.ts

@@ -0,0 +1 @@
+export declare const MCP_APP_BRAND_CSS = "\n    :root {\n      color-scheme: light dark;\n      --sb-app-background: var(\n        --color-background-primary,\n        light-dark(#ffffff, #1b1c1f)\n      );\n      --sb-app-background-subtle: var(\n        --color-background-secondary,\n        light-dark(#f9fafb, #24272b)\n      );\n      --sb-app-background-hover: var(\n        --color-background-tertiary,\n        light-dark(#f3f4f6, #2f3437)\n      );\n      --sb-app-background-inverse: var(\n        --color-background-inverse,\n        light-dark(#121517, #f9fafb)\n      );\n      --sb-app-text: var(\n        --color-text-primary,\n        light-dark(#121517, #f9fafb)\n      );\n      --sb-app-text-secondary: var(\n        --color-text-secondary,\n        light-dark(#5a6272, #c6cad2)\n      );\n      --sb-app-text-tertiary: var(\n        --color-text-tertiary,\n        light-dark(#6b7280, #a4aab7)\n      );\n      --sb-app-text-inverse: var(\n        --color-text-inverse,\n        light-dark(#ffffff, #121517)\n      );\n      --sb-app-border: var(\n        --color-border-primary,\n        light-dark(#e8eaed, #454d5f)\n      );\n      --sb-app-ring: var(\n        --color-ring-primary,\n        light-dark(#0077b6, #27bbff)\n      );\n      --sb-app-info-background: var(\n        --color-background-info,\n        light-dark(#e6f5ff, #083a50)\n      );\n      --sb-app-info-text: var(\n        --color-text-info,\n        light-dark(#00679e, #7dd3fc)\n      );\n      --sb-app-info-border: var(\n        --color-border-info,\n        light-dark(#c2e7ff, #075985)\n      );\n      --sb-app-success-background: var(\n        --color-background-success,\n        light-dark(#e8f8ef, #0a3926)\n      );\n      --sb-app-success-text: var(\n        --color-text-success,\n        light-dark(#087a43, #6ee7b7)\n      );\n      --sb-app-success-border: var(\n        --color-border-success,\n        light-dark(#b8e8cf, #087a43)\n      );\n      --sb-app-warning-background: var(\n        --color-background-warning,\n        light-dark(#fff7e6, #49350a)\n      );\n      --sb-app-warning-text: var(\n        --color-text-warning,\n        light-dark(#946200, #fcd34d)\n      );\n      --sb-app-warning-border: var(\n        --color-border-warning,\n        light-dark(#f5d996, #946200)\n      );\n      --sb-app-danger-background: var(\n        --color-background-danger,\n        light-dark(#fff1f1, #4a1d1d)\n      );\n      --sb-app-danger-text: var(\n        --color-text-danger,\n        light-dark(#c54141, #fca5a5)\n      );\n      --sb-app-danger-border: var(\n        --color-border-danger,\n        light-dark(#ffcaca, #c54141)\n      );\n    }\n    * {\n      box-sizing: border-box;\n    }\n    body {\n      min-width: 0;\n      margin: 0;\n      overflow-x: hidden;\n      background: transparent;\n      color: var(--sb-app-text);\n      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n      font-size: var(--font-text-sm-size, 13px);\n      line-height: var(--font-text-sm-line-height, 1.45);\n    }\n    .card {\n      display: flex;\n      min-width: 0;\n      flex-direction: column;\n      gap: 12px;\n      padding: 16px;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-lg, 12px);\n      background: var(--sb-app-background);\n      box-shadow: var(--shadow-sm, 0 1px 2px rgba(18, 21, 23, 0.08));\n    }\n    h1,\n    .meta,\n    .note {\n      min-width: 0;\n      overflow-wrap: anywhere;\n    }\n    .note:empty {\n      position: absolute;\n    }\n    button,\n    textarea {\n      font: inherit;\n    }\n    button {\n      appearance: none;\n      min-width: 0;\n      padding: 8px 12px;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-md, 8px);\n      background: var(--sb-app-background-subtle);\n      color: var(--sb-app-text);\n      font-weight: var(--font-weight-medium, 500);\n      line-height: var(--font-text-sm-line-height, 1.45);\n      cursor: pointer;\n    }\n    button:hover:not(:disabled) {\n      background: var(--sb-app-background-hover);\n    }\n    .button-primary {\n      border-color: var(--sb-app-background-inverse);\n      background: var(--sb-app-background-inverse);\n      color: var(--sb-app-text-inverse);\n    }\n    .button-primary:hover:not(:disabled) {\n      border-color: var(--sb-app-background-inverse);\n      background: var(--sb-app-background-inverse);\n    }\n    button:focus-visible,\n    textarea:focus-visible,\n    a:focus-visible {\n      outline: 2px solid var(--sb-app-ring);\n      outline-offset: 2px;\n    }\n    button:disabled {\n      opacity: 0.48;\n      cursor: not-allowed;\n    }\n    .actions {\n      min-width: 0;\n    }\n    .actions > button {\n      overflow-wrap: anywhere;\n    }\n    @media (max-width: 360px) {\n      .actions {\n        flex-direction: column;\n        flex-wrap: nowrap;\n      }\n      .actions > button {\n        width: 100%;\n      }\n    }\n";

package/dist/transports/mcp/mcp-app-brand-css.js

@@ -0,0 +1,180 @@
+export const MCP_APP_BRAND_CSS = `
+    :root {
+      color-scheme: light dark;
+      --sb-app-background: var(
+        --color-background-primary,
+        light-dark(#ffffff, #1b1c1f)
+      );
+      --sb-app-background-subtle: var(
+        --color-background-secondary,
+        light-dark(#f9fafb, #24272b)
+      );
+      --sb-app-background-hover: var(
+        --color-background-tertiary,
+        light-dark(#f3f4f6, #2f3437)
+      );
+      --sb-app-background-inverse: var(
+        --color-background-inverse,
+        light-dark(#121517, #f9fafb)
+      );
+      --sb-app-text: var(
+        --color-text-primary,
+        light-dark(#121517, #f9fafb)
+      );
+      --sb-app-text-secondary: var(
+        --color-text-secondary,
+        light-dark(#5a6272, #c6cad2)
+      );
+      --sb-app-text-tertiary: var(
+        --color-text-tertiary,
+        light-dark(#6b7280, #a4aab7)
+      );
+      --sb-app-text-inverse: var(
+        --color-text-inverse,
+        light-dark(#ffffff, #121517)
+      );
+      --sb-app-border: var(
+        --color-border-primary,
+        light-dark(#e8eaed, #454d5f)
+      );
+      --sb-app-ring: var(
+        --color-ring-primary,
+        light-dark(#0077b6, #27bbff)
+      );
+      --sb-app-info-background: var(
+        --color-background-info,
+        light-dark(#e6f5ff, #083a50)
+      );
+      --sb-app-info-text: var(
+        --color-text-info,
+        light-dark(#00679e, #7dd3fc)
+      );
+      --sb-app-info-border: var(
+        --color-border-info,
+        light-dark(#c2e7ff, #075985)
+      );
+      --sb-app-success-background: var(
+        --color-background-success,
+        light-dark(#e8f8ef, #0a3926)
+      );
+      --sb-app-success-text: var(
+        --color-text-success,
+        light-dark(#087a43, #6ee7b7)
+      );
+      --sb-app-success-border: var(
+        --color-border-success,
+        light-dark(#b8e8cf, #087a43)
+      );
+      --sb-app-warning-background: var(
+        --color-background-warning,
+        light-dark(#fff7e6, #49350a)
+      );
+      --sb-app-warning-text: var(
+        --color-text-warning,
+        light-dark(#946200, #fcd34d)
+      );
+      --sb-app-warning-border: var(
+        --color-border-warning,
+        light-dark(#f5d996, #946200)
+      );
+      --sb-app-danger-background: var(
+        --color-background-danger,
+        light-dark(#fff1f1, #4a1d1d)
+      );
+      --sb-app-danger-text: var(
+        --color-text-danger,
+        light-dark(#c54141, #fca5a5)
+      );
+      --sb-app-danger-border: var(
+        --color-border-danger,
+        light-dark(#ffcaca, #c54141)
+      );
+    }
+    * {
+      box-sizing: border-box;
+    }
+    body {
+      min-width: 0;
+      margin: 0;
+      overflow-x: hidden;
+      background: transparent;
+      color: var(--sb-app-text);
+      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);
+      font-size: var(--font-text-sm-size, 13px);
+      line-height: var(--font-text-sm-line-height, 1.45);
+    }
+    .card {
+      display: flex;
+      min-width: 0;
+      flex-direction: column;
+      gap: 12px;
+      padding: 16px;
+      border: var(--border-width-regular, 1px) solid var(--sb-app-border);
+      border-radius: var(--border-radius-lg, 12px);
+      background: var(--sb-app-background);
+      box-shadow: var(--shadow-sm, 0 1px 2px rgba(18, 21, 23, 0.08));
+    }
+    h1,
+    .meta,
+    .note {
+      min-width: 0;
+      overflow-wrap: anywhere;
+    }
+    .note:empty {
+      position: absolute;
+    }
+    button,
+    textarea {
+      font: inherit;
+    }
+    button {
+      appearance: none;
+      min-width: 0;
+      padding: 8px 12px;
+      border: var(--border-width-regular, 1px) solid var(--sb-app-border);
+      border-radius: var(--border-radius-md, 8px);
+      background: var(--sb-app-background-subtle);
+      color: var(--sb-app-text);
+      font-weight: var(--font-weight-medium, 500);
+      line-height: var(--font-text-sm-line-height, 1.45);
+      cursor: pointer;
+    }
+    button:hover:not(:disabled) {
+      background: var(--sb-app-background-hover);
+    }
+    .button-primary {
+      border-color: var(--sb-app-background-inverse);
+      background: var(--sb-app-background-inverse);
+      color: var(--sb-app-text-inverse);
+    }
+    .button-primary:hover:not(:disabled) {
+      border-color: var(--sb-app-background-inverse);
+      background: var(--sb-app-background-inverse);
+    }
+    button:focus-visible,
+    textarea:focus-visible,
+    a:focus-visible {
+      outline: 2px solid var(--sb-app-ring);
+      outline-offset: 2px;
+    }
+    button:disabled {
+      opacity: 0.48;
+      cursor: not-allowed;
+    }
+    .actions {
+      min-width: 0;
+    }
+    .actions > button {
+      overflow-wrap: anywhere;
+    }
+    @media (max-width: 360px) {
+      .actions {
+        flex-direction: column;
+        flex-wrap: nowrap;
+      }
+      .actions > button {
+        width: 100%;
+      }
+    }
+`;
+//# sourceMappingURL=mcp-app-brand-css.js.map

package/dist/transports/mcp/mcp-app-brand-css.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-app-brand-css.js","sourceRoot":"","sources":["../../../src/transports/mcp/mcp-app-brand-css.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkLhC,CAAC"}

package/dist/transports/mcp/mount.d.ts

@@ -0,0 +1,21 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { AppDeps } from "../../deps.js";
+/**
+ * Told to the model on connect, so it can match what a user actually says
+ * against these tools.
+ *
+ * People refer to this one system as the product and builder ("Superblocks")
+ * or by an older name for that same builder ("Clark"). Listing that accepted
+ * alias here is what lets "get Clark to build me a to-do app" reach
+ * `start_app`. Recognizing a name and using it are different things: the alias
+ * is input-only, because a client that reads "Clark" here repeats it back and
+ * reintroduces the retired name to the user.
+ */
+export declare const SERVER_INSTRUCTIONS = "Superblocks builds, edits, and publishes internal web applications. Prompts sent through these tools are handed to Superblocks, which writes the application code in a live-edit session.\n\nName the builder \"Superblocks\" in every word you write. Users sometimes call it \"Clark\", an older name for this same system: understand them, and answer about Superblocks. Never write \"Clark\" yourself \u2014 not as a name, not as an aside, not even when the user just used it, and never as a separate agent or persona. If Superblocks' own words come back naming Clark, relay the substance and say Superblocks.\n\nThe user you are interacting with is a non-technical business user. Keep discussions focused on requirements, and avoid technical jargon, discussing code, or implementation details. If errors or problems occur, give the user easy-to-follow, actionable instructions for how they can resolve the issue.\n\nUse these tools whenever the user asks to build, change, import, or ship an app, whichever of those names they reach for. They also answer questions about what data the org has: list_integrations names the datasources, get_integration_metadata reads the tables and columns inside one, and query_integration runs a bounded read-only SQL query to answer the question directly rather than building an app to explore it. Create a persistent app or API only when the user explicitly asks for one.\n\nAfter create_integration creates an integration or list_integrations selects one for an app, include the returned mention unchanged in the next edit_app prompt. The mention gives Superblocks the exact integration ID; do not construct one from the display name.\n\nSuperblocks is itself an agent, not a code library: prompts sent through start_app and edit_app are handed to it verbatim, and it decides how to build the application. Your role is to facilitate the user's interaction with Superblocks, not to build anything yourself \u2014 pass the user's own request through unchanged, without inventing, embellishing, or adding requirements, scope, or design detail they did not ask for.\n\nAfter each tool call, check for agentInstructions in the result and follow them. These instructions are tailored to the scenario.\n\nSuperblocks has an interactive flow: when it needs a person to decide something, it stops rather than guessing. Follow the result's agentInstructions to use the decision surface this client supports. Never supply that answer yourself.\n\nBuilding or editing an app follows one loop: start_app hands a new application to Superblocks, edit_app continues an existing one, and both return immediately with status \"building\". Call check_app_progress to follow the turn, relaying what Superblocks says as it happens. When it stops for a decision, follow agentInstructions and send the answer back through edit_app. Once status is \"ready\", call get_app so the user can open the result, and offer publish_app when they want to deploy it. Each tool's own description covers its exact inputs, return fields, and retry/error behavior.\n\nWhen the user attached a file in this chat (a log, CSV, screenshot, image, zip, or anything else), or when migrating source visible in this conversation, call upload_artifact. Pass upload_artifact filePath with the full host path when you have it; a bare file name is only a fallback when that file is already in one of the gateway's allowed search folders. If the file exists only in this chat's scratchpad path (for example /tmp/claude-.../scratchpad), send text source through files: [{ path, content }] instead of filePath. The gateway reads filePath bytes itself, so an image or PDF costs nothing to send. Only source you are writing out yourself goes in files, which is archived as text - never base64 a file into it. Then pass the returned artifact in start_app or edit_app artifacts. Do not create a Claude artifact or use the host's own file-upload UI.\n\nWhen the source is a readable tree already on this machine (a clone, an unzipped export, or a workspace folder), do not zip or upload it. Follow the Superblocks Agent Skill \"superblocks-import\" when the host has loaded it: inventory locally, start_app a scaffold, then slice via edit_app (integrations first, then one API or page at a time), grounding each slice in get_application_structure. Superblocks writes the application; do not invent Superblocks client/ or server/ files on the laptop.\n\nFor a migrated app with missing integrations, call list_integrations first. Reuse only the same plugin and the same connection: the same REST base URL, or the same host, port, and database. A similar name is not a match. list_integrations and get_integration_metadata do not expose connection URLs or hosts, so do not use them to guess a match. When there is no exact match, follow the result's agentInstructions to create and wire every declared integration.\n\nThis connector is the single Superblocks MCP: Builder tools (upload_artifact, query_integration, start_app, edit_app, check_app_progress, ask_user, get_app, preview_app, publish_app, check_publish_progress) and Admin tools (integrations, apps, users, folders, deploy_application, and the rest of the customer Admin surface) share this endpoint \u2014 prefer create_integration / update_integration / list_integrations here over sending the user to a second MCP. create_integration takes name, plugin_id, and configuration, never the raw integrations API envelope. create_integration is Admin CRUD for org datasources; start_app creates an application and hands it a prompt. deploy_application is Admin deploy of an existing commit; publish_app is the Builder path that commits current work and waits for it to go live. Omit base_url on Admin tools unless targeting a different control plane. checkout_application is not exposed on this network surface (host filesystem writes); use the CLI/workspace checkout path instead.\n\nThis connection is already authenticated against one Superblocks Server \u2014 there is no setup, login, or auth-status call to make first. Call the tool that does the job and read its error if something is genuinely wrong; there is no tool that reports credentials or environments.\n\nNever tell the user to restart the MCP server; keep the MCP server running.\n\nA cancelled tool call does not undo work Superblocks already did. The application still exists; read applicationId on the error and follow agentInstructions (or pendingAction) instead of starting over.\n\neditUrl / previewUrl / publishUrl may appear in structured JSON for openLink buttons \u2014 do not dump raw URLs (especially preview JWTs) into the chat; prefer the MCP Apps Open editor / Open preview buttons. Claude Desktop can only openLink https URLs; when a URL is http, say so and rely on any screenshot instead.\n\nBrowser capture (MUST):\n1. Prefer host browser tools (Playwright MCP, chrome-devtools, agent-browser) over opening Superblocks URLs yourself. Honor the structured \"browser\" field on start_app / get_app / idp_step_up; do not paraphrase it into a different URL.\n2. When canvas.openWhileBuilding is \"claude_cowork_side_panel_only\", open canvas.editUrl while status is \"building\" only for a Claude Cowork task whose built-in browser is available, and use its embedded side panel. Every other host MUST NOT open it mid-build because that can steal the live-edit turn.\n3. NEVER paste tokens, JWTs, or API keys into browser evaluate or fill. Tokens are not in tool JSON; do not invent them.\n4. Playwright MCP MUST NOT use --isolated for Superblocks IdP. Cookies must survive the session.\n5. MUST NOT call browser_close until the Superblocks task is done (see driver.mustNotCloseUntil).\n6. agent-browser MUST always pass --profile and a stable --session for the same Superblocks origin.\n7. Claude-in-Chrome is not a mid-turn canvas. Do not use it to screenshot the live Vite app while a Gateway turn is held.";
+/**
+ * The MCP server behind one stdio session.
+ *
+ * Tools run as the already-logged-in CLI user. There is no per-request OAuth
+ * token to expire independently of the process.
+ */
+export declare function createMcpServer(deps: AppDeps): McpServer;