@superblocksteam/gateway 2.0.155-next.0

package/LICENSE.txt

@@ -0,0 +1,87 @@
+Superblocks Community Software License
+
+This Superblocks Community License Agreement (the “Agreement”) sets forth the terms on which DayZero
+Software, Inc. d/b/a Superblocks (“Superblocks”) makes available certain software made available by Superblocks
+under this Agreement (the “Software”). BY INSTALLING, DOWNLOADING, ACCESSING, USING OR
+DISTRIBUTING ANY OF THE SOFTWARE, YOU AGREE TO THE TERMS AND CONDITIONS OF THIS
+AGREEMENT.IF YOU DO NOT AGREE TO SUCH TERMS AND CONDITIONS, YOU MUST NOT USE THE
+SOFTWARE. IF YOU ARE RECEIVING THE SOFTWARE ON BEHALF OF A LEGAL ENTITY, YOU
+REPRESENT AND WARRANT THAT YOU HAVE THE ACTUAL AUTHORITY TO AGREE TO THE
+TERMS AND CONDITIONS OF THIS AGREEMENT ON BEHALF OF SUCH ENTITY. “Licensee” means you,
+an individual, or the entity on whose behalf you are receiving the Software.
+
+1. LICENSE GRANT AND CONDITIONS.
+
+1.1 License. Subject to the terms and conditions of this Agreement, Superblocks hereby grants to Licensee a
+non-exclusive, royalty-free, worldwide, non-transferable, non-sublicenseable license during the term of this
+Agreement to: (a) use the Software; (b) prepare modifications and derivative works of the Software; (c)
+distribute the Software (including without limitation in source code or object code form); and (d) reproduce
+copies of the Software (the “License”). Licensee is not granted the right to, and Licensee shall not, exercise the
+License for an Excluded Purpose. For purposes of this Agreement, “Excluded Purpose” means making
+available any software-as-a-service, platform-as-a-service, infrastructure-as-a-service or other similar online
+service that competes with Superblocks’ products or services.
+
+1.2 Conditions. In consideration of the License, Licensee’s distribution of the Software is subject to the
+following conditions:
+
+  a. Licensee must cause any Software modified by Licensee to carry prominent notices stating that Licensee
+  modified the Software.
+  b. On each Software copy, Licensee shall reproduce and not remove or alter all Superblocks or third party
+  copyright or other proprietary notices contained in the Software, and Licensee must provide the notice
+  below with each copy.
+
+  “This software is made available by DayZero Software, Inc. d/b/a Superblocks, under the terms of the
+  Superblocks Community License Agreement. © 2022 DayZero Software, Inc.”
+
+1.3 Licensee Modifications. Licensee may add its own copyright notices to modifications made by Licensee
+and may provide additional or different license terms and conditions for use, reproduction, or distribution of
+Licensee’s modifications. While redistributing the Software or modifications thereof, Licensee may choose to
+offer, for a fee or free of charge, support, warranty, indemnity, or other obligations. Licensee, and not
+Superblocks, will be responsible for any such obligations.
+
+1.4 No Sublicensing. The License does not include the right to sublicense the Software, however, each recipient
+to which Licensee provides the Software may exercise the Licenses so long as such recipient agrees to the terms
+and conditions of this Agreement.
+
+2. TERM AND TERMINATION. This Agreement will continue unless and until earlier terminated as set forth
+herein. If Licensee breaches any of its conditions or obligations under this Agreement, this Agreement will
+terminate automatically and the License will terminate automatically and permanently.
+
+3. INTELLECTUAL PROPERTY. As between the parties, Superblocks will retain all right, title, and interest in
+the Software, and all intellectual property rights therein. Superblocks hereby reserves all rights not expressly
+granted to Licensee in this Agreement. Superblocks hereby reserves all rights in its trademarks and service
+marks, and no licenses therein are granted in this Agreement.
+
+4. DISCLAIMER. SUPERBLOCKS HEREBY DISCLAIMS ANY AND ALL WARRANTIES AND
+CONDITIONS, EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND SPECIFICALLY
+DISCLAIMS ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE, WITH RESPECT TO THE SOFTWARE.
+
+5. LIMITATION OF LIABILITY. SUPERBLOCKS WILL NOT BE LIABLE FOR ANY DAMAGES OF
+ANY KIND, INCLUDING BUT NOT LIMITED TO, LOST PROFITS OR ANY CONSEQUENTIAL,
+SPECIAL, INCIDENTAL, INDIRECT, OR DIRECT DAMAGES, HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, ARISING OUT OF THIS AGREEMENT. THE FOREGOING SHALL APPLY TO
+THE EXTENT PERMITTED BY APPLICABLE LAW.
+
+6. GENERAL.
+
+6.1  Governing Law. This Agreement will be governed by and interpreted in accordance with the laws of the
+state of California, without reference to its conflict of laws principles. If Licensee is located within the United
+States, all disputes arising out of this Agreement are subject to the exclusive jurisdiction of courts located in San
+Mateo County, California. USA. If Licensee is located outside of the United States, any dispute, controversy or
+claim arising out of or relating to this Agreement will be referred to and finally determined by arbitration in
+accordance with the JAMS International Arbitration Rules. The tribunal will consist of one neutral arbitrator.
+The place of arbitration will be Palo Alto, California. The language to be used in the arbitral proceedings will be
+English. Judgment upon the award rendered by the arbitrator may be entered in any court having jurisdiction
+thereof.
+
+6.2.  Assignment. Licensee may not assign its rights under this Agreement to any third party. Superblocks may
+freely assign its rights under this Agreement to any third party.
+
+6.3.  Other.  This Agreement is the entire agreement between the parties regarding the subject matter hereof.
+No amendment or modification of this Agreement will be valid or binding upon the parties unless made in
+writing and signed by the duly authorized representatives of both parties. In the event that any provision,
+including without limitation any condition, of this Agreement is held to be unenforceable, this Agreement and
+all licenses and rights granted hereunder will immediately terminate. Waiver by Superblocks of a breach of any
+provision of this Agreement or the failure by Superblocks to exercise any right hereunder will not be construed
+as a waiver of any subsequent breach of that right or as a waiver of any other right.

package/README.md

@@ -0,0 +1,170 @@
+# Gateway v0
+
+Standalone Superblocks entry point for a **single MCP connector** (Admin + Builder)
+over **stdio**, running as the already-logged-in Superblocks CLI user.
+
+Builder tools (`start_app`, `import_app`, `edit_app`, `check_app_progress`,
+`get_app`, `preview_app`, `publish_app`) plus customer Admin tools from
+`@superblocksteam/mcp-server` share this process.
+
+The MCP host owns process lifecycle: it spawns `superblocks gateway serve`.
+There is no foreground HTTP `/mcp`, no OAuth resource server, and no linked-grant
+exchange. Personal API keys here are the CLI session
+(`~/.superblocks/auth.json` / `SUPERBLOCKS_AUTH_FILE` / `just worktree auth`).
+
+Scope notes:
+
+- In-memory stores only; no Redis (ENG-5594).
+- CLI identity only. Linked MCP grants, static `GATEWAY_DEV_SUPERBLOCKS_API_KEY`,
+  and on-behalf-of exchange are not supported.
+- Missing Playwright Chromium does not block start (ENG-5796). Screenshots fail
+  closed when Chromium is absent.
+- No Slack wrapper (ENG-5596).
+- Orchestrator URL is discovered from Server agent inventory, not configured here.
+
+## Internal review
+
+```bash
+# Log in if needed (same CLI session the Gateway will use)
+superblocks login
+
+# Write a stdio MCP entry into the client config
+superblocks gateway setup --client claude
+# or: --client cursor / --client claude-desktop / --client generic
+
+# Restart the MCP host. It spawns Gateway; do not run gateway serve yourself.
+```
+
+`setup` writes an absolute spawn so the host does not depend on cwd.
+Published `bin/run.js` is the MCP `command` (its `node` shebang applies).
+Worktree `bin/dev.js` is launched with `tsx` and without `--watch`: the
+dev shebang is a file-watcher, which would kill stdio on source edits and
+corrupt JSON-RPC on stdout. When `SUPERBLOCKS_AUTH_FILE` or
+`SUPERBLOCKS_BASE_URL` is set (worktree auth), those are copied into the MCP
+`env` block.
+
+Optional: `--with-screenshots` downloads Playwright Chromium for preview
+captures. Omit it; start still succeeds.
+
+## Local run
+
+The MCP host spawns Gateway. Do not run `gateway serve` in a TTY.
+
+Against a remote Superblocks domain (EE / SaaS IR):
+
+```bash
+cd packages/cli/packages/cli
+./bin/dev.js config set domain <host>
+./bin/dev.js login
+./bin/dev.js gateway setup --client claude
+```
+
+Against a local control plane, start the stack first (`just up <worktree>`),
+then login and `gateway setup` the same way.
+
+`superblocks mcp serve` (stdio Admin-only) is deprecated; prefer `gateway setup`.
+
+## Worktree MCP (Cursor / Claude)
+
+Until published packages are on PATH, point the MCP host at this checkout.
+Log in and run setup from the worktree CLI (not a globally installed `superblocks`):
+
+```bash
+cd packages/cli/packages/cli
+./bin/dev.js config set domain <host>
+./bin/dev.js login
+./bin/dev.js gateway setup --client cursor
+# or: --client claude
+```
+
+`setup` writes an absolute stdio spawn into the host config (`~/.cursor/mcp.json`
+for Cursor, `~/.claude.json` for Claude Code):
+
+```json
+{
+  "mcpServers": {
+    "superblocks": {
+      "command": "/absolute/path/to/tsx/cli.mjs",
+      "args": [
+        "/absolute/path/to/packages/cli/packages/cli/bin/dev.js",
+        "gateway",
+        "serve"
+      ],
+      "env": {
+        "SUPERBLOCKS_AUTH_FILE": "/absolute/path/to/worktree/.superblocks/auth.json",
+        "SUPERBLOCKS_BASE_URL": "https://your-control-plane"
+      }
+    }
+  }
+}
+```
+
+`command` is `tsx` without `--watch`: the `bin/dev.js` shebang is a file
+watcher, which would kill stdio on source edits and corrupt JSON-RPC on
+stdout. `env` only copies the CLI session (`SUPERBLOCKS_AUTH_FILE`,
+`SUPERBLOCKS_BASE_URL`). Do not add `SUPERBLOCKS_GATEWAY_FROM_SOURCE`.
+Optional stderr tees (`2>> ~/.cursor/superblocks-gateway.err`) are host
+specific; `setup` does not write them.
+
+Restart the MCP host after `setup` and after every rebuild below.
+
+### Rebuild after source changes
+
+Cursor MCP still goes through oclif `dist/index.js`. CLI esbuild inlines
+`@superblocksteam/gateway`, so a Gateway `tsc` alone does not update the
+process the host spawns.
+
+| You changed                                                     | Rebuild                                        |
+| --------------------------------------------------------------- | ---------------------------------------------- |
+| `packages/shared` (types Gateway imports, e.g. SocketHeartbeat) | `pnpm --filter @superblocksteam/shared build`  |
+| `packages/gateway/src`                                          | `pnpm --filter @superblocksteam/gateway build` |
+| Gateway, CLI serve wiring, or anything oclif esbuild inlines    | `pnpm --filter @superblocksteam/cli build`     |
+
+A typical Gateway capture change is shared (if types moved), then Gateway,
+then CLI. Then restart Cursor.
+
+Proof the new bundle is live: Gateway stderr logs
+`gateway live canvas capture uses libraryBrowserContext (testingEnabled does not gate it)`
+at boot. A crash that `@superblocksteam/shared` does not export
+`SocketHeartbeat` means shared `dist/` is stale.
+
+## Authentication
+
+Gateway tools call the Superblocks control plane with the personal API key from
+the CLI session. Log in first (`superblocks login`). There is no issuer env, no
+consent page, and no second PAT.
+
+## Cloud-Prem laptop agent
+
+Set `GATEWAY_LOCAL_AGENT=true` for a single-user corp laptop process. Stores are
+always in-memory; suspended turns and progress cursors do not survive a restart.
+`SUPERBLOCKS_SERVER_URL` (or `GATEWAY_SERVER_URL`) points at the in-VPC control
+plane. The CLI session supplies identity.
+
+Set `GATEWAY_ADMIN_TOOLS_ONLY=true` alongside `GATEWAY_LOCAL_AGENT=true` to
+package only the customer Admin surface. Builder tools are not registered.
+
+## MCP tools
+
+After `gateway setup`, restart Claude Code or Cursor and call `start_app`,
+`edit_app`, `check_app_progress`, `get_app`, `preview_app`, and `publish_app`.
+See `.env.example` for optional configuration.
+
+## Env
+
+See `.env.example`. Stores are in-memory only. Identity comes from the CLI
+session, not from these variables.
+
+| Variable                   | Purpose                                                    |
+| -------------------------- | ---------------------------------------------------------- |
+| `SUPERBLOCKS_SERVER_URL`   | Control plane URL (default from `auth.json` or localhost). |
+| `GATEWAY_PROFILE_KEY`      | Integration profile key (default `default`).               |
+| `GATEWAY_LOCAL_AGENT`      | Cloud-Prem laptop agent mode.                              |
+| `GATEWAY_ADMIN_TOOLS_ONLY` | Admin tools only; skip Builder surface.                    |
+| `SUPERBLOCKS_AUTH_FILE`    | Worktree-local CLI session (from `just worktree auth`).    |
+| `NODE_DEBUG=gateway`       | Tool call stacks and conditional-flow logs on stderr.      |
+
+Gateway debug logs include tool names, result states, decision branches, and
+entry-point stacks. They intentionally omit credentials, prompts, answers, and
+result payloads. Run `superblocks gateway setup --client <client> --debug`, then
+restart the MCP host. Re-run setup without `--debug` to turn them off.

package/dist/agents/resolve-orchestrator-url.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Picks an orchestrator (agent) base URL the way the browser does: from the
+ * Server's agent inventory for the org, filtered by org agent type, Active
+ * status, and profile tags. Operators never set this URL.
+ */
+export type OrchestratorAgentCandidate = {
+    status: string;
+    tags: Record<string, string[]>;
+    type: number;
+    url: string;
+};
+export type PickOrchestratorBaseUrlInput = {
+    agentType: number;
+    agents: OrchestratorAgentCandidate[];
+    profileKey: string;
+};
+/**
+ * Returns a single orchestrator base URL from Server-reported agents.
+ * Throws when none are eligible — same failure mode as the browser's
+ * "No active agent found".
+ */
+export declare function pickOrchestratorBaseUrl(input: PickOrchestratorBaseUrlInput): string;

package/dist/agents/resolve-orchestrator-url.js

@@ -0,0 +1,38 @@
+/**
+ * Picks an orchestrator (agent) base URL the way the browser does: from the
+ * Server's agent inventory for the org, filtered by org agent type, Active
+ * status, and profile tags. Operators never set this URL.
+ */
+const ACTIVE_STATUS = "Active";
+function matchesProfile(tags, profileKey) {
+    const profiles = tags.profile;
+    if (!profiles || profiles.length === 0) {
+        // Cloud sentinel and untagged agents are eligible for any profile.
+        return true;
+    }
+    return profiles.includes("*") || profiles.includes(profileKey);
+}
+function withTrailingSlash(url) {
+    return url.endsWith("/") ? url : `${url}/`;
+}
+/**
+ * Returns a single orchestrator base URL from Server-reported agents.
+ * Throws when none are eligible — same failure mode as the browser's
+ * "No active agent found".
+ */
+export function pickOrchestratorBaseUrl(input) {
+    const eligible = input.agents.filter((candidate) => candidate.type === input.agentType &&
+        candidate.status === ACTIVE_STATUS &&
+        Boolean(candidate.url) &&
+        matchesProfile(candidate.tags ?? {}, input.profileKey));
+    if (eligible.length === 0) {
+        throw new Error(`No active agent found for agentType=${input.agentType} profile=${input.profileKey}`);
+    }
+    // Browser picks randomly among matches; stable first is fine for gateway.
+    const chosen = eligible[0];
+    if (!chosen) {
+        throw new Error(`No active agent found for agentType=${input.agentType} profile=${input.profileKey}`);
+    }
+    return withTrailingSlash(chosen.url);
+}
+//# sourceMappingURL=resolve-orchestrator-url.js.map

package/dist/agents/resolve-orchestrator-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-orchestrator-url.js","sourceRoot":"","sources":["../../src/agents/resolve-orchestrator-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,SAAS,cAAc,CACrB,IAA8B,EAC9B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAClC,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;QAClC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;QACtB,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CACzD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}

package/dist/capabilities/import-prompt.d.ts

@@ -0,0 +1,11 @@
+import type { ImportAppSource } from "./types.js";
+/**
+ * Archive names land in instruction-bearing prompt text. Keep a single-line
+ * basename so a crafted zip path cannot inject newlines or role-play into Clark.
+ */
+export declare function sanitizeArchiveDisplayName(zipFileName: string): string;
+export declare function buildImportPrompt(input: {
+    extraPrompt?: string;
+    source: ImportAppSource;
+    zipFileName: string;
+}): string;

package/dist/capabilities/import-prompt.js

@@ -0,0 +1,96 @@
+/**
+ * Migration prompts mirror the browser MigrationModal templates so Clark loads
+ * the same skills and inspects the attached archive the same way.
+ */
+/**
+ * The browser migration flow leans on the `third-party-migration` skill, which
+ * ends by deferring verification to "the user running the app" — and is dropped
+ * entirely unless the org has `ui.third-party-import.enabled`. Neither holds
+ * here: no one is clicking through a headless migration, and the gateway hands
+ * Clark the org's integrations plus a live `testApi` on every turn. Say so in
+ * the prompt rather than hoping a skill is loaded.
+ */
+const API_VERIFICATION_INSTRUCTION = `Nobody is watching this migration in a browser, so you verify your own work. This turn's context lists the org's integrations — use them for the data sources you find in the project. Run every API you create or change through testApi before you report the migration finished, and say what testApi returned, failures included. Do not defer API verification to the user, and do not treat testApi as unavailable during a migration.`;
+function withMigrationSkillInstruction(prompt) {
+    return `Please follow the migration guidelines as detailed in your skillset.
+
+${prompt}`;
+}
+/**
+ * Archive names land in instruction-bearing prompt text. Keep a single-line
+ * basename so a crafted zip path cannot inject newlines or role-play into Clark.
+ */
+export function sanitizeArchiveDisplayName(zipFileName) {
+    const base = zipFileName.replace(/\\/g, "/").split("/").pop() ?? "archive.zip";
+    let cleaned = "";
+    for (const ch of base) {
+        const code = ch.codePointAt(0) ?? 0;
+        // Drop C0 controls and DEL so a crafted basename cannot inject newlines
+        // into instruction-bearing prompt text.
+        if (code >= 32 && code !== 127) {
+            cleaned += ch;
+        }
+    }
+    cleaned = cleaned.trim();
+    return cleaned.length > 0 ? cleaned : "archive.zip";
+}
+function genericImportPrompt(zipFileName) {
+    return withMigrationSkillInstruction(`Import this codebase into Superblocks. The project is attached as ${zipFileName}. Inspect the structure, identify the framework and data sources, then migrate it into the current Superblocks fullstack app.`);
+}
+const SOURCE_PROMPTS = {
+    chatgpt: genericImportPrompt,
+    claude: genericImportPrompt,
+    "claude-design": (zipFileName) => withMigrationSkillInstruction(`Migrate this Claude Design app into Superblocks. The exported project is attached as ${zipFileName}.`),
+    lovable: (zipFileName) => withMigrationSkillInstruction(`Migrate this Lovable app into Superblocks. The exported project is attached as ${zipFileName}.`),
+    replit: (zipFileName) => withMigrationSkillInstruction(`Migrate this Replit app into Superblocks. The exported project is attached as ${zipFileName}.`),
+    streamlit: genericImportPrompt,
+    v0: (zipFileName) => withMigrationSkillInstruction(`Migrate this v0 app into Superblocks. The exported project is attached as ${zipFileName}.`),
+    zip: genericImportPrompt,
+};
+/**
+ * Builds the Clark prompt for an import turn. Optional `extraPrompt` is the
+ * caller's intent (e.g. "make it more secure"), appended after the template.
+ */
+function promptForSource(source, zipFileName) {
+    // Exhaustive switch with direct calls — no dynamic property lookup — so
+    // CodeQL cannot treat `source` as an unvalidated method name.
+    switch (source) {
+        case "chatgpt":
+            return SOURCE_PROMPTS.chatgpt(zipFileName);
+        case "claude":
+            return SOURCE_PROMPTS.claude(zipFileName);
+        case "claude-design":
+            return SOURCE_PROMPTS["claude-design"](zipFileName);
+        case "lovable":
+            return SOURCE_PROMPTS.lovable(zipFileName);
+        case "replit":
+            return SOURCE_PROMPTS.replit(zipFileName);
+        case "streamlit":
+            return SOURCE_PROMPTS.streamlit(zipFileName);
+        case "v0":
+            return SOURCE_PROMPTS.v0(zipFileName);
+        case "zip":
+            return SOURCE_PROMPTS.zip(zipFileName);
+        default: {
+            const _exhaustive = source;
+            throw new Error(`unsupported import source: ${String(_exhaustive)}`);
+        }
+    }
+}
+export function buildImportPrompt(input) {
+    const zipFileName = sanitizeArchiveDisplayName(input.zipFileName);
+    const base = promptForSource(input.source, zipFileName);
+    const extra = input.extraPrompt?.trim();
+    // Verification goes last: a caller asking to "just get it running" should not
+    // end up with a migration that reports untested APIs.
+    const intent = extra
+        ? `${base}
+
+Additional instructions from the user:
+${extra}`
+        : base;
+    return `${intent}
+
+${API_VERIFICATION_INSTRUCTION}`;
+}
+//# sourceMappingURL=import-prompt.js.map

package/dist/capabilities/import-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-prompt.js","sourceRoot":"","sources":["../../src/capabilities/import-prompt.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,8aAA8a,CAAC;AAEpd,SAAS,6BAA6B,CAAC,MAAc;IACnD,OAAO;;EAEP,MAAM,EAAE,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,IAAI,GACR,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,aAAa,CAAC;IACpE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,wEAAwE;QACxE,wCAAwC;QACxC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,OAAO,6BAA6B,CAClC,qEAAqE,WAAW,+HAA+H,CAChN,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAClB;IACE,OAAO,EAAE,mBAAmB;IAC5B,MAAM,EAAE,mBAAmB;IAC3B,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAC/B,6BAA6B,CAC3B,wFAAwF,WAAW,GAAG,CACvG;IACH,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CACvB,6BAA6B,CAC3B,kFAAkF,WAAW,GAAG,CACjG;IACH,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,CACtB,6BAA6B,CAC3B,iFAAiF,WAAW,GAAG,CAChG;IACH,SAAS,EAAE,mBAAmB;IAC9B,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAClB,6BAA6B,CAC3B,6EAA6E,WAAW,GAAG,CAC5F;IACH,GAAG,EAAE,mBAAmB;CACzB,CAAC;AAEJ;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAuB,EAAE,WAAmB;IACnE,wEAAwE;IACxE,8DAA8D;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,eAAe;YAClB,OAAO,cAAc,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,CAAC;QACtD,KAAK,SAAS;YACZ,OAAO,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,KAAK,WAAW;YACd,OAAO,cAAc,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,KAAK,IAAI;YACP,OAAO,cAAc,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACxC,KAAK,KAAK;YACR,OAAO,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,MAAM,WAAW,GAAG,0BAA0B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxC,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,GAAG,IAAI;;;EAGX,KAAK,EAAE;QACL,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,GAAG,MAAM;;EAEhB,4BAA4B,EAAE,CAAC;AACjC,CAAC"}

package/dist/capabilities/lifecycle.d.ts

@@ -0,0 +1,73 @@
+import type { CaptureLibraryScreenshot } from "../capture/capture-library.js";
+import type { GatewayConfig } from "../config.js";
+import type { EventStore } from "../events/types.js";
+import type { CapturePreviewScreenshot } from "../preview/capture-screenshot.js";
+import type { CallerRef, ProgressStore, RecentAppStore, TurnStore } from "../resume/types.js";
+import type { SessionPeer } from "../sabs/session-peer.js";
+import type { SuperblocksServerClient } from "../server/client.js";
+import type { CapabilityResult, CheckAppProgressInput, CheckAppProgressResult, EditAppInput, EditAppResult, GetAppInput, GetAppResult, ImportAppInput, ImportAppResult, PreviewAppInput, PreviewAppResult, Principal, ProgressEvent, PublishAppInput, PublishAppResult, StartAppInput, StartAppResult } from "./types.js";
+export { IMPORT_ZIP_MAX_BYTES } from "./types.js";
+export type CapabilityContext = {
+    /**
+     * Who is polling, for resume. Absent on one-shot capability calls that do
+     * not poll, in which case no cursor is kept.
+     */
+    caller?: CallerRef;
+    config: GatewayConfig;
+    /**
+     * Durable history of the live-edit session. This is what a caller reads
+     * when there is no local turn to ask — after a restart, on another replica,
+     * or from a channel that never started the build.
+     */
+    events?: EventStore;
+    /** Injected so pacing and stall thresholds are testable without real time. */
+    now?: () => number;
+    onProgress?: (event: ProgressEvent) => void;
+    principal: Principal;
+    /** Where each caller's place in the event stream is kept between calls. */
+    progressCursors?: ProgressStore;
+    recentApps: RecentAppStore;
+    /**
+     * Optional headless capture of the live library iframe (pitcherURL). Injected
+     * in tests; defaults to Playwright in the MCP transport. Distinct from
+     * {@link capturePreviewScreenshot} (deployed shell).
+     */
+    captureLibraryScreenshot?: CaptureLibraryScreenshot;
+    /**
+     * Optional headless capture used when Claude cannot openLink an https URL.
+     * Injected in tests; defaults to Playwright in the MCP transport.
+     */
+    capturePreviewScreenshot?: CapturePreviewScreenshot;
+    server: SuperblocksServerClient;
+    sessionPeer: SessionPeer;
+    /** The caller gave up on this call (an MCP cancellation, a closed request). */
+    signal?: AbortSignal;
+    turns: TurnStore;
+};
+export declare function startApp(ctx: CapabilityContext, input: StartAppInput): Promise<CapabilityResult<StartAppResult>>;
+/**
+ * Creates a fullstack app, uploads the caller's archive as an app attachment,
+ * and hands Clark a migration prompt — the same path as the browser import
+ * wizard, without the sessionStorage hop.
+ */
+export declare function importApp(ctx: CapabilityContext, input: ImportAppInput): Promise<CapabilityResult<ImportAppResult>>;
+export declare function checkAppProgress(ctx: CapabilityContext, input: CheckAppProgressInput): Promise<CapabilityResult<CheckAppProgressResult>>;
+export declare function editApp(ctx: CapabilityContext, input: EditAppInput): Promise<CapabilityResult<EditAppResult>>;
+/**
+ * Shows the app's current work on a real URL without deploying it - the
+ * editor's Preview button, driven from here.
+ *
+ * Three steps, the same ones and in the same order as the editor: snapshot the
+ * live-edit state as a commit, make sure a build exists for that commit's
+ * content, and hand back the URL that serves it. Builds are keyed on content
+ * rather than on the commit, so previewing work that was already built (by an
+ * earlier preview, or by a publish) waits on that build instead of starting a
+ * second one.
+ */
+export declare function previewApp(ctx: CapabilityContext, input: PreviewAppInput): Promise<CapabilityResult<PreviewAppResult>>;
+/**
+ * Lovable-style lookup: editor URL always, preview URLs when a build can be
+ * ensured (default). Captures a screenshot whenever the preview is ready.
+ */
+export declare function getApp(ctx: CapabilityContext, input: GetAppInput): Promise<CapabilityResult<GetAppResult>>;
+export declare function publishApp(ctx: CapabilityContext, input: PublishAppInput): Promise<CapabilityResult<PublishAppResult>>;