@superblocksteam/gateway 2.0.155-next.0

package/dist/server/identity-reads.js

@@ -0,0 +1,209 @@
+import { createHash } from "node:crypto";
+/**
+ * The identity lookup did not produce an answer this caller can act on.
+ *
+ * Distinct from "the credential was refused": nothing is known about the
+ * caller's account, so the right response is to try again rather than to
+ * re-link. Capabilities map this to `downstream_unavailable`.
+ */
+export class IdentityUnavailableError extends Error {
+    reason;
+    constructor(message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = "IdentityUnavailableError";
+        this.reason = options.reason ?? "read_failed";
+    }
+}
+/**
+ * Short enough that losing access or switching org lands within a minute,
+ * long enough that a poll loop stops paying for a round trip per call.
+ */
+const DEFAULT_CACHE_TTL_MS = 60_000;
+/**
+ * The tool contract promises callers an answer in about ten seconds, so that
+ * is the longest a tool call waits on identity. The read itself is not
+ * cancelled at this point — see {@link withGuardedIdentityReads}.
+ */
+const DEFAULT_CALLER_WAIT_MS = 10_000;
+/**
+ * How long a wedged endpoint is taken at its word. Long enough that a burst of
+ * polls costs one read rather than one per call, short enough that recovery is
+ * noticed without anyone restarting a client.
+ */
+const DEFAULT_COOLDOWN_MS = 30_000;
+/** Cached entries are swept once the map is big enough for it to be worth it. */
+const PRUNE_AT_ENTRIES = 512;
+const OUTAGE_MESSAGE = "The Superblocks API could not confirm who this caller is in time. This is usually transient — try again in a moment.";
+/**
+ * A deadline a caller can stop waiting at without cancelling what it waits on.
+ */
+function callerDeadline(ms) {
+    let timer;
+    const expired = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new IdentityUnavailableError(OUTAGE_MESSAGE, {
+            reason: "caller_timeout",
+        })), ms);
+    });
+    return { cancel: () => clearTimeout(timer), expired };
+}
+/**
+ * Makes the identity lookup that every tool call gates on cheap and bounded.
+ *
+ * `GET /api/v1/users/me` is the first thing every capability does and the
+ * slowest endpoint the Superblocks API exposes. Read straight through, one
+ * wedged upstream took down the whole tool surface: each call waited out the
+ * full client timeout, a burst of callers multiplied the load on the endpoint
+ * that was already stuck, and nothing remembered that the last twenty calls
+ * had just failed the same way.
+ *
+ * Four things fix that, and they have to work together:
+ *
+ * - **Cache.** Identity does not change between polls, so a poll loop spends
+ *   one read per TTL instead of one per call.
+ * - **Collapse.** Concurrent callers on a cold cache join one read rather than
+ *   each starting their own.
+ * - **Caller deadline.** A tool call stops waiting at the window its own
+ *   contract advertises. The read keeps running, so an endpoint that answers
+ *   slowly still fills the cache and the next call is served from it — the
+ *   reason this is a deadline on the wait and not a shorter timeout on the
+ *   read.
+ * - **Breaker.** Once a read fails, later calls fail fast for a cooldown
+ *   instead of each discovering the same outage the slow way.
+ */
+export function withGuardedIdentityReads(read, options = {}) {
+    const now = options.now ?? Date.now;
+    const cacheTtlMs = options.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+    const callerWaitMs = options.callerWaitMs ?? DEFAULT_CALLER_WAIT_MS;
+    const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+    const onOutcome = options.onOutcome ?? (() => undefined);
+    const opensBreaker = options.opensBreaker ?? (() => true);
+    // Hashed so raw credentials are never held as map keys.
+    const cache = new Map();
+    const inflight = new Map();
+    let failFastUntil = 0;
+    // The breaker has tripped and nothing has succeeded since. While that holds,
+    // the cooldown expiring admits exactly one probe rather than one per
+    // credential. Collapsing is keyed per credential, so without this a burst of
+    // distinct callers each opened its own read against the wedged route the
+    // moment the cooldown lapsed -- eight agents, eight probes, every 30s.
+    let recovering = false;
+    let probeInFlight = false;
+    // Errors `opensBreaker` judged to be about one credential. They propagate
+    // raw, so the caller still sees its own 401 rather than a wrapped one, and
+    // this is what lets the outcome be labelled without re-inspecting them here.
+    // Weak so a rejected read holds nothing once its error is collected.
+    const credentialErrors = new WeakSet();
+    function prune() {
+        if (cache.size < PRUNE_AT_ENTRIES) {
+            return;
+        }
+        const timestamp = now();
+        for (const [key, entry] of cache) {
+            if (entry.expiresAt <= timestamp) {
+                cache.delete(key);
+            }
+        }
+    }
+    function startRead(key, apiKey) {
+        const pending = (async () => {
+            try {
+                const value = await read(apiKey);
+                failFastUntil = 0;
+                recovering = false;
+                // `undefined` means the API refused this credential. Caching that
+                // would keep refusing a caller who has since re-linked their account.
+                if (value !== undefined) {
+                    prune();
+                    cache.set(key, { expiresAt: now() + cacheTtlMs, value });
+                }
+                return value;
+            }
+            catch (error) {
+                if (!opensBreaker(error)) {
+                    // The endpoint answered — it just refused this caller. That is proof
+                    // of life, so it closes the breaker rather than leaving it half-open:
+                    // holding it open on the strength of a refusal would serialize every
+                    // later read behind the one-probe gate for as long as refusals kept
+                    // arriving, answering `breaker_open` to healthy callers against a
+                    // healthy endpoint.
+                    failFastUntil = 0;
+                    recovering = false;
+                    if (typeof error === "object" && error !== null) {
+                        credentialErrors.add(error);
+                    }
+                    throw error;
+                }
+                failFastUntil = now() + cooldownMs;
+                recovering = true;
+                // The raw failure names a timeout on an endpoint the caller never
+                // asked for, which reads as "the gateway is broken". This says what
+                // the caller can actually do about it.
+                throw new IdentityUnavailableError(OUTAGE_MESSAGE, {
+                    cause: error,
+                    reason: "read_failed",
+                });
+            }
+            finally {
+                inflight.delete(key);
+                probeInFlight = false;
+            }
+        })();
+        inflight.set(key, pending);
+        return pending;
+    }
+    function classifyFailure(error) {
+        if (error instanceof IdentityUnavailableError) {
+            return error.reason === "caller_timeout" ? "caller_timeout" : "outage";
+        }
+        if (typeof error === "object" && error !== null) {
+            // Raw and not wrapped: `startRead` decided this one is the credential's
+            // fault, not the endpoint's. Calling it an outage would put a healthy
+            // endpoint in the outage bucket every time a stale key retries.
+            return credentialErrors.has(error) ? "credential_error" : "outage";
+        }
+        return "outage";
+    }
+    return async function guardedRead(apiKey) {
+        const key = createHash("sha256").update(apiKey).digest("hex");
+        const cached = cache.get(key);
+        if (cached) {
+            if (cached.expiresAt > now()) {
+                onOutcome("cached");
+                return cached.value;
+            }
+            cache.delete(key);
+        }
+        // A read already running is the one to wait on even while the breaker is
+        // open: it is the probe that will close it.
+        let pending = inflight.get(key);
+        if (!pending) {
+            // Open, or half-open with the one probe already out.
+            if (failFastUntil > now() || (recovering && probeInFlight)) {
+                onOutcome("breaker_open");
+                throw new IdentityUnavailableError(OUTAGE_MESSAGE, {
+                    reason: "breaker_open",
+                });
+            }
+            if (recovering) {
+                probeInFlight = true;
+            }
+            pending = startRead(key, apiKey);
+        }
+        // Promise.race keeps a rejection handler on `pending` for its whole life,
+        // so a read that fails after this caller gave up stays handled.
+        const deadline = callerDeadline(callerWaitMs);
+        try {
+            const value = await Promise.race([pending, deadline.expired]);
+            onOutcome(value === undefined ? "refused" : "resolved");
+            return value;
+        }
+        catch (error) {
+            onOutcome(classifyFailure(error));
+            throw error;
+        }
+        finally {
+            deadline.cancel();
+        }
+    };
+}
+//# sourceMappingURL=identity-reads.js.map

package/dist/server/identity-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reads.js","sourceRoot":"","sources":["../../src/server/identity-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAA4B;IAE3C,YACE,OAAe,EACf,UAAmE,EAAE;QAErE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAChD,CAAC;CACF;AAyCD;;;GAGG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,cAAc,GAClB,sHAAsH,CAAC;AAIzH;;GAEG;AACH,SAAS,cAAc,CAAC,EAAU;IAIhC,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACtD,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,wBAAwB,CAAC,cAAc,EAAE;YAC3C,MAAM,EAAE,gBAAgB;SACzB,CAAC,CACH,EACH,EAAE,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAqB,EACrB,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,GAAS,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE1D,wDAAwD;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC3D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,6EAA6E;IAC7E,qEAAqE;IACrE,6EAA6E;IAC7E,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;IAE/C,SAAS,KAAK;QACZ,IAAI,KAAK,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,GAAW,EAAE,MAAc;QAC5C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,aAAa,GAAG,CAAC,CAAC;gBAClB,UAAU,GAAG,KAAK,CAAC;gBACnB,kEAAkE;gBAClE,sEAAsE;gBACtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,EAAE,CAAC;oBACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,qEAAqE;oBACrE,sEAAsE;oBACtE,qEAAqE;oBACrE,oEAAoE;oBACpE,kEAAkE;oBAClE,oBAAoB;oBACpB,aAAa,GAAG,CAAC,CAAC;oBAClB,UAAU,GAAG,KAAK,CAAC;oBACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBAChD,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,aAAa,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;gBACnC,UAAU,GAAG,IAAI,CAAC;gBAClB,kEAAkE;gBAClE,oEAAoE;gBACpE,uCAAuC;gBACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,aAAa;iBACtB,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,aAAa,GAAG,KAAK,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,eAAe,CAAC,KAAc;QACrC,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,wEAAwE;YACxE,sEAAsE;YACtE,gEAAgE;YAChE,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,UAAU,WAAW,CAAC,MAAc;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;gBAC7B,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC,KAAK,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,qDAAqD;YACrD,IAAI,aAAa,GAAG,GAAG,EAAE,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,EAAE,CAAC;gBAC3D,SAAS,CAAC,cAAc,CAAC,CAAC;gBAC1B,MAAM,IAAI,wBAAwB,CAAC,cAAc,EAAE;oBACjD,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/start.d.ts

@@ -0,0 +1,14 @@
+import { type GatewayConfig } from "./config.js";
+export type StartGatewayOptions = {
+    /** Personal API key of the already-logged-in Superblocks CLI user. */
+    apiKey: string;
+};
+export type StartedGateway = {
+    close: () => Promise<void>;
+    config: GatewayConfig;
+};
+/**
+ * Boots Gateway MCP over stdio as the CLI user. Shared by
+ * `superblocks gateway serve` (the IR path) and `node dist/main.js`.
+ */
+export declare function startStdioGateway(options: StartGatewayOptions): Promise<StartedGateway>;

package/dist/start.js

@@ -0,0 +1,75 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { loadConfig } from "./config.js";
+import { installFaultBarrier } from "./process/fault-barrier.js";
+import { createStores } from "./resume/stores.js";
+import { WebSocketSessionPeer } from "./sabs/websocket-session-peer.js";
+import { HttpSuperblocksServerClient } from "./server/client.js";
+import { createMcpServer } from "./transports/mcp/mount.js";
+/**
+ * Chromium never blocks Gateway start. Preview screenshots fail closed when
+ * Playwright is missing (ENG-5796).
+ */
+async function createRuntime(apiKey) {
+    const config = loadConfig();
+    const stores = await createStores();
+    const serverClient = new HttpSuperblocksServerClient(config.serverUrl);
+    const sessionPeer = new WebSocketSessionPeer({
+        beatLostGraceMs: config.beatLostGraceMs,
+        idleMs: config.heldSessionIdleMs,
+        profileKey: config.profileKey,
+        readyWaitMs: config.clarkReadyWaitMs,
+        releaseAfterTurnMs: config.heldSessionReleaseAfterTurnMs,
+        server: serverClient,
+        settleMs: config.clarkSettleMs,
+        testingEnabled: config.clarkTestingEnabled,
+        turnTimeoutMs: config.clarkTurnTimeoutMs,
+        uiBaseUrl: config.uiBaseUrl,
+    });
+    const deps = {
+        cliApiKey: apiKey,
+        config,
+        events: stores.events,
+        progressCursors: stores.progressCursors,
+        recentApps: stores.recentApps,
+        server: serverClient,
+        sessionPeer,
+        turns: stores.turns,
+    };
+    return {
+        config,
+        deps,
+        close: async () => {
+            sessionPeer.closeAll();
+            await stores.close();
+        },
+    };
+}
+/**
+ * Boots Gateway MCP over stdio as the CLI user. Shared by
+ * `superblocks gateway serve` (the IR path) and `node dist/main.js`.
+ */
+export async function startStdioGateway(options) {
+    const apiKey = options.apiKey.trim();
+    if (!apiKey) {
+        throw new Error("Not logged in to Superblocks. Run: superblocks login");
+    }
+    const runtime = await createRuntime(apiKey);
+    const disposeFaultBarrier = installFaultBarrier({
+        onFault: () => undefined,
+        shutdown: () => runtime.close(),
+    });
+    const server = createMcpServer(runtime.deps);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("gateway MCP listening on stdio as the Superblocks CLI user");
+    console.error("gateway live canvas capture uses libraryBrowserContext (testingEnabled does not gate it)", { testingEnabled: runtime.config.clarkTestingEnabled });
+    return {
+        config: runtime.config,
+        close: async () => {
+            disposeFaultBarrier();
+            await server.close().catch(() => undefined);
+            await runtime.close();
+        },
+    };
+}
+//# sourceMappingURL=start.js.map

package/dist/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAY5D;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,MAAc;IAKzC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,IAAI,2BAA2B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,oBAAoB,CAAC;QAC3C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,iBAAiB;QAChC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,gBAAgB;QACpC,kBAAkB,EAAE,MAAM,CAAC,6BAA6B;QACxD,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,MAAM,CAAC,aAAa;QAC9B,cAAc,EAAE,MAAM,CAAC,mBAAmB;QAC1C,aAAa,EAAE,MAAM,CAAC,kBAAkB;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAY;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,YAAY;QACpB,WAAW;QACX,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;IACF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,WAAW,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B;IAE5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;QAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,OAAO,CAAC,KAAK,CACX,0FAA0F,EAC1F,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,CACvD,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,mBAAmB,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/telemetry/metrics.d.ts

@@ -0,0 +1,32 @@
+import type { IdentityReadOutcome } from "../server/identity-reads.js";
+export declare const identityReadOutcomes: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
+/**
+ * How the identity lookup behind a capability is behaving.
+ *
+ * No credential, user, or organization is ever a label — the outcome is a
+ * closed set, so the series count grows with code and not with traffic.
+ */
+export declare function recordIdentityReadOutcome(outcome: IdentityReadOutcome): void;
+export declare const processFaults: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
+/**
+ * How often the gateway is absorbing faults it used to die from (ENG-5809).
+ *
+ * Neither the message nor a stack is a label; both go to the log line instead.
+ */
+export declare function recordGatewayFault(fault: {
+    fatal: boolean;
+    kind: string;
+}): void;
+export declare const readinessVerdicts: import("@opentelemetry/api").Counter<import("@opentelemetry/api").Attributes>;
+/**
+ * Separates "this gateway is broken" from "the platform it fronts is down".
+ *
+ * Kept so in-process dispatch probes can still record a verdict. Stdio Gateway
+ * does not bind `/health`.
+ */
+export declare function recordReadinessVerdict(input: {
+    dispatch: string;
+    probe: "liveness" | "readiness";
+    ready: boolean;
+    upstream: string;
+}): void;

package/dist/telemetry/metrics.js

@@ -0,0 +1,57 @@
+import { metrics } from "@opentelemetry/api";
+const meter = metrics.getMeter("gateway");
+function resourceAttributes() {
+    return {
+        "deployment.environment.name": process.env.DEPLOYMENT_ENVIRONMENT_NAME ?? "local",
+        "service.name": "gateway",
+    };
+}
+export const identityReadOutcomes = meter.createCounter("gateway.identity.read.outcomes", {
+    description: "Caller-identity lookups by outcome: served from cache, resolved, refused, or unavailable",
+});
+/**
+ * How the identity lookup behind a capability is behaving.
+ *
+ * No credential, user, or organization is ever a label — the outcome is a
+ * closed set, so the series count grows with code and not with traffic.
+ */
+export function recordIdentityReadOutcome(outcome) {
+    identityReadOutcomes.add(1, {
+        ...resourceAttributes(),
+        "gateway.outcome": outcome,
+    });
+}
+export const processFaults = meter.createCounter("gateway.process.faults", {
+    description: "Faults the process-level barrier caught, by kind and whether it gave up the process",
+});
+/**
+ * How often the gateway is absorbing faults it used to die from (ENG-5809).
+ *
+ * Neither the message nor a stack is a label; both go to the log line instead.
+ */
+export function recordGatewayFault(fault) {
+    processFaults.add(1, {
+        ...resourceAttributes(),
+        "gateway.fault.fatal": String(fault.fatal),
+        "gateway.fault.kind": fault.kind,
+    });
+}
+export const readinessVerdicts = meter.createCounter("gateway.readiness.verdicts", {
+    description: "Health and readiness probe verdicts, by dispatch state and upstream reachability",
+});
+/**
+ * Separates "this gateway is broken" from "the platform it fronts is down".
+ *
+ * Kept so in-process dispatch probes can still record a verdict. Stdio Gateway
+ * does not bind `/health`.
+ */
+export function recordReadinessVerdict(input) {
+    readinessVerdicts.add(1, {
+        ...resourceAttributes(),
+        "gateway.readiness.dispatch": input.dispatch,
+        "gateway.readiness.probe": input.probe,
+        "gateway.readiness.ready": String(input.ready),
+        "gateway.readiness.upstream": input.upstream,
+    });
+}
+//# sourceMappingURL=metrics.js.map

package/dist/telemetry/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/telemetry/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI7C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAE1C,SAAS,kBAAkB;IACzB,OAAO;QACL,6BAA6B,EAC3B,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,OAAO;QACpD,cAAc,EAAE,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,aAAa,CACrD,gCAAgC,EAChC;IACE,WAAW,EACT,0FAA0F;CAC7F,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA4B;IACpE,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE;QAC1B,GAAG,kBAAkB,EAAE;QACvB,iBAAiB,EAAE,OAAO;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAAE;IACzE,WAAW,EACT,qFAAqF;CACxF,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE;QACnB,GAAG,kBAAkB,EAAE;QACvB,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1C,oBAAoB,EAAE,KAAK,CAAC,IAAI;KACjC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC,aAAa,CAClD,4BAA4B,EAC5B;IACE,WAAW,EACT,kFAAkF;CACrF,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAKtC;IACC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE;QACvB,GAAG,kBAAkB,EAAE;QACvB,4BAA4B,EAAE,KAAK,CAAC,QAAQ;QAC5C,yBAAyB,EAAE,KAAK,CAAC,KAAK;QACtC,yBAAyB,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAC9C,4BAA4B,EAAE,KAAK,CAAC,QAAQ;KAC7C,CAAC,CAAC;AACL,CAAC"}

package/dist/transports/mcp/admin-tools.d.ts

@@ -0,0 +1,47 @@
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+import { z } from "zod";
+import { type ToolRegistry } from "@superblocksteam/mcp-server";
+export type RegisterAdminToolsOptions = {
+    /**
+     * Superblocks Server base URL injected as `base_url` when the caller omits it.
+     * Models should not invent environments; the gateway already knows the control plane.
+     */
+    serverUrl: string;
+    /**
+     * Fixed credential for tests and tightly scoped callers. Prefer `resolveApiKey`
+     * on the live HTTP path so each tool call uses the caller's downstream key.
+     */
+    apiKey?: string;
+    resolveApiKey?: (auth: AuthInfo | undefined) => Promise<string>;
+    /**
+     * Cloud-Prem / laptop Admin agents (`GATEWAY_LOCAL_AGENT`) talk to a control
+     * plane that carries no SaaS billing plan, so the Admin tools' Enterprise/POC
+     * plan lookup would refuse every call. Entitlement for those installs is
+     * established by the deployment itself. SaaS-hosted Gateways leave this off
+     * and keep the check.
+     */
+    localAgentMode?: boolean;
+};
+export type JsonSchemaToZodShapeOptions = {
+    /** Advertised as optional no matter what the source schema requires. */
+    optionalKeys?: readonly string[];
+};
+/**
+ * Loose JSON-Schema -> Zod conversion so `registerTool` can list Admin tools
+ * with usable shapes. Handlers still validate through `@superblocksteam/mcp-server`.
+ */
+export declare function jsonSchemaToZodShape(inputSchema: Tool["inputSchema"], options?: JsonSchemaToZodShapeOptions): Record<string, z.ZodType>;
+/**
+ * Gateway product copy names the builder Superblocks. Admin tool definitions
+ * still mention the retired "Clark" alias in places; rewrite for this surface
+ * so clients do not reintroduce that name.
+ */
+export declare function superblocksProductCopy(text: string): string;
+/**
+ * Registers customer-profile Admin MCP tools on the same McpServer as Builder
+ * tools. Each call runs under `runWithAuthContext` with the Gateway's
+ * downstream credential, against the `serverUrl` that credential belongs to.
+ */
+export declare function registerAdminTools(server: McpServer, options: RegisterAdminToolsOptions): ToolRegistry;

package/dist/transports/mcp/admin-tools.js

@@ -0,0 +1,164 @@
+import { z } from "zod";
+import { buildToolRegistry, executeToolCall, runWithAuthContext, toolDefinitions, } from "@superblocksteam/mcp-server";
+import { gatewayDebug, gatewayDebugStack } from "../../debug.js";
+/**
+ * Loose JSON-Schema -> Zod conversion so `registerTool` can list Admin tools
+ * with usable shapes. Handlers still validate through `@superblocksteam/mcp-server`.
+ */
+export function jsonSchemaToZodShape(inputSchema, options = {}) {
+    const properties = inputSchema?.properties ?? {};
+    const required = new Set(inputSchema?.required ?? []);
+    for (const key of options.optionalKeys ?? []) {
+        required.delete(key);
+    }
+    const shape = {};
+    for (const [key, prop] of Object.entries(properties)) {
+        let field = jsonSchemaPropertyToZod(prop ?? {});
+        if (!required.has(key)) {
+            field = field.optional();
+        }
+        shape[key] = field;
+    }
+    return shape;
+}
+/**
+ * Arguments the gateway fills in itself, so the model never has to go find
+ * them. A required `base_url` reads as missing information: rather than call
+ * the tool it was asked for, a client goes hunting for the environment first.
+ */
+const GATEWAY_SUPPLIED_ARGUMENTS = {
+    base_url: "Omit this. The gateway always sends its own Superblocks Server URL; any value here is replaced.",
+};
+/**
+ * Admin tools the gateway keeps to itself.
+ *
+ * `get_auth_status` answers questions already settled before the model sees a
+ * tool (the CLI session already authenticated; the gateway injects its Server URL).
+ *
+ * `checkout_application` writes caller-controlled paths on the gateway host
+ * filesystem. Keep that off stdio MCP until a sandboxed destination model lands;
+ * use the CLI/workspace checkout path instead.
+ */
+const OMITTED_ADMIN_TOOLS = new Set([
+    "checkout_application",
+    "get_auth_status",
+]);
+function gatewayAdminInputShape(inputSchema) {
+    const shape = jsonSchemaToZodShape(inputSchema, {
+        optionalKeys: Object.keys(GATEWAY_SUPPLIED_ARGUMENTS),
+    });
+    for (const [key, description] of Object.entries(GATEWAY_SUPPLIED_ARGUMENTS)) {
+        const field = shape[key];
+        if (field) {
+            shape[key] = field.describe(description);
+        }
+    }
+    return shape;
+}
+function jsonSchemaPropertyToZod(prop) {
+    if (prop.enum && prop.enum.length > 0) {
+        const values = prop.enum.filter((v) => typeof v === "string");
+        if (values.length === prop.enum.length && values.length > 0) {
+            return z.enum(values);
+        }
+    }
+    const rawType = Array.isArray(prop.type) ? prop.type[0] : prop.type;
+    switch (rawType) {
+        case "string":
+            return z.string();
+        case "number":
+        case "integer":
+            return z.number();
+        case "boolean":
+            return z.boolean();
+        case "array":
+            return z.array(prop.items ? jsonSchemaPropertyToZod(prop.items) : z.unknown());
+        case "object":
+            if (prop.properties) {
+                return z
+                    .object(jsonSchemaToZodShape({
+                    type: "object",
+                    properties: prop.properties,
+                    required: prop.required,
+                }))
+                    .passthrough();
+            }
+            return z.record(z.string(), z.unknown());
+        default:
+            return z.unknown();
+    }
+}
+function resolveToken(options, auth) {
+    if (options.resolveApiKey) {
+        return options.resolveApiKey(auth);
+    }
+    if (options.apiKey) {
+        return Promise.resolve(options.apiKey);
+    }
+    return Promise.reject(new Error("Admin tools require apiKey or resolveApiKey"));
+}
+/**
+ * Gateway product copy names the builder Superblocks. Admin tool definitions
+ * still mention the retired "Clark" alias in places; rewrite for this surface
+ * so clients do not reintroduce that name.
+ */
+export function superblocksProductCopy(text) {
+    return text
+        .replaceAll(/\bClark AI Apps\b/g, "Superblocks AI Apps")
+        .replaceAll(/\bClark\b/g, "Superblocks");
+}
+/**
+ * Registers customer-profile Admin MCP tools on the same McpServer as Builder
+ * tools. Each call runs under `runWithAuthContext` with the Gateway's
+ * downstream credential, against the `serverUrl` that credential belongs to.
+ */
+export function registerAdminTools(server, options) {
+    const registry = buildToolRegistry(toolDefinitions, "customer", {
+        requireEntitledPlan: options.localAgentMode !== true,
+    });
+    for (const tool of registry.listTools()) {
+        if (OMITTED_ADMIN_TOOLS.has(tool.name)) {
+            continue;
+        }
+        const definition = toolDefinitions.find((d) => d.name === tool.name);
+        server.registerTool(tool.name, {
+            annotations: tool.annotations,
+            description: superblocksProductCopy(tool.description ?? ""),
+            inputSchema: gatewayAdminInputShape(tool.inputSchema),
+            title: tool.title ?? definition?.title,
+        }, async (args, extra) => {
+            gatewayDebugStack("admin tool started", {
+                "tool.argument_keys": Object.keys(args).sort(),
+                "tool.name": tool.name,
+            });
+            try {
+                const token = await resolveToken(options, extra.authInfo);
+                const baseUrl = options.serverUrl.replace(/\/$/, "");
+                const callArgs = {
+                    ...args,
+                    // Overwritten, never merged. The credential this call runs with belongs
+                    // to the Gateway's own control plane, so a base_url from the model
+                    // would send that credential to a host the model chose - reachable
+                    // through any prompt injection that gets as far as a tool call.
+                    base_url: baseUrl,
+                };
+                const result = await runWithAuthContext({ baseUrl, token }, () => executeToolCall(tool.name, callArgs, registry));
+                gatewayDebug("admin tool finished", {
+                    "result.kind": "success",
+                    "tool.name": tool.name,
+                });
+                return result;
+            }
+            catch (error) {
+                gatewayDebug("admin tool finished", {
+                    "error.type": error instanceof Error ? error.constructor.name : typeof error,
+                    "result.kind": "error",
+                    "tool.name": tool.name,
+                });
+                throw error;
+            }
+        });
+    }
+    return registry;
+}
+//# sourceMappingURL=admin-tools.js.map

package/dist/transports/mcp/admin-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-tools.js","sourceRoot":"","sources":["../../../src/transports/mcp/admin-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,GAEhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyCjE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAgC,EAChC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GACb,WAAW,EAAE,UAEA,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAA2B;IACzD,QAAQ,EACN,iGAAiG;CACpG,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,WAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC9C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;KACtD,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CACZ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC;qBACL,MAAM,CACL,oBAAoB,CAAC;oBACnB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CACH;qBACA,WAAW,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAkC,EAClC,IAA0B;IAE1B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,6CAA6C,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACvD,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,EAAE;QAC9D,mBAAmB,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;KACrD,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3D,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,KAAK;SACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,iBAAiB,CAAC,oBAAoB,EAAE;gBACtC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAA4B;oBACxC,GAAI,IAAgC;oBACpC,wEAAwE;oBACxE,mEAAmE;oBACnE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/D,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;gBACF,YAAY,CAAC,qBAAqB,EAAE;oBAClC,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,qBAAqB,EAAE;oBAClC,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;oBAChE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}