@superglue/cli 1.1.21 → 1.1.23

package/dist/skills/superglue/references/postgres.md

@@ -0,0 +1,154 @@
+# PostgreSQL
+
+## Step Configuration
+
+```typescript
+{
+  type: "request",
+  systemId: "my_postgres_db",
+  url: "postgres://<<my_postgres_db_user>>:<<my_postgres_db_password>>@<<my_postgres_db_host>>:<<my_postgres_db_port>>/<<my_postgres_db_database>>",
+  body: '{"query": "SELECT * FROM users WHERE id = $1", "params": [<<userId>>]}'
+}
+```
+
+Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+
+`method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
+
+### Fields
+
+| Field      | Required | Notes                                                          |
+| ---------- | -------- | -------------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
+| `body`     | yes      | JSON string with `query` and optional `params`                 |
+| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+
+### URL Format
+
+```
+postgres://user:password@host:port/database
+postgresql://user:password@host:port/database
+```
+
+Both `postgres://` and `postgresql://` are supported. Trailing slashes and extra slashes before query strings are cleaned automatically.
+
+### Body Format
+
+JSON string with `query` and optional `params` (or `values`):
+
+```json
+{ "query": "SELECT * FROM users WHERE age > $1 AND status = $2", "params": [25, "active"] }
+```
+
+## Authentication
+
+Credentials are embedded directly in the connection URL using `<<systemId_credentialKey>>` placeholders. Nothing is injected automatically.
+
+```
+postgres://<<my_db_user>>:<<my_db_password>>@<<my_db_host>>:<<my_db_port>>/<<my_db_database>>
+```
+
+Credential variables are resolved at runtime before connecting.
+
+## PostgreSQL Runtime Details
+
+### Schema Discovery
+
+superglue does not auto-introspect Postgres schemas. Before building tools, always query the schema manually with `sg system call` to discover tables and columns:
+
+```json
+{
+  "query": "SELECT table_name, column_name, data_type, is_nullable FROM information_schema.columns WHERE table_schema = 'public' ORDER BY table_name, ordinal_position"
+}
+```
+
+Always verify table and column names against the actual schema before building tools.
+
+### Parameterized Queries
+
+Always use parameterized queries with `$1`, `$2`, etc. — prevents SQL injection.
+
+```json
+{ "query": "SELECT * FROM orders WHERE customer_id = $1", "params": ["<<customerId>>"] }
+```
+
+With expressions:
+
+```json
+{
+  "query": "INSERT INTO logs (message, level) VALUES ($1, $2)",
+  "params": ["<<(sourceData) => sourceData.message>>", "error"]
+}
+```
+
+With RETURNING:
+
+```json
+{
+  "query": "INSERT INTO users (name, email) VALUES ($1, $2) RETURNING *",
+  "params": [
+    "<<(sourceData) => sourceData.currentItem.name>>",
+    "<<(sourceData) => sourceData.currentItem.email>>"
+  ]
+}
+```
+
+### Return Value
+
+Returns `result.rows` — array of row objects with column names as keys.
+
+- `SELECT`: array of matching rows
+- `INSERT/UPDATE/DELETE` with `RETURNING`: array of returned rows
+- Mutations without `RETURNING`: empty array
+
+### Batch Operations
+
+Use a data selector returning an array to execute a query per item:
+
+```javascript
+// dataSelector: (sourceData) => sourceData.newUsers
+// body: {"query": "INSERT INTO users (name) VALUES ($1)", "params": ["<<(sourceData) => sourceData.currentItem.name>>"]}
+```
+
+### Connection Pooling
+
+- Pools cached by connection string, max 10 clients, 30s connection timeout
+- Idle pools cleaned up automatically
+
+### SSL / TLS
+
+SSL is auto-configured based on the connection URL — you do not need to set it manually in most cases.
+
+**Default behavior (no `sslmode` in URL):**
+
+- `localhost` / `127.0.0.1` → SSL disabled
+- All other hosts → superglue probes the server to detect SSL support and enables it if the server accepts SSL handshakes. If the probe fails or times out, SSL is enabled as a safe default.
+
+**Explicit `sslmode` in URL** (appended as `?sslmode=...`):
+
+- `sslmode=disable` → SSL off
+- `sslmode=require` → SSL on, enforced
+- `sslmode=verify-ca` / `sslmode=verify-full` → SSL on, enforced; AWS RDS CA bundle loaded if present on disk
+- Any other sslmode value → SSL on, not enforced
+
+Server certificate chain validation is not performed by default; `verify-ca` / `verify-full` only flip the `enforce` flag and opportunistically load the RDS CA bundle. If strict chain validation matters for your deployment, terminate TLS at a trusted proxy.
+
+### Retry Behavior
+
+Default retries from server config. On final failure, error includes query text and params.
+
+## Common Pitfalls
+
+- Using string interpolation instead of parameterized queries — always use `$1`, `$2` with `params` array
+- Forgetting `RETURNING *` on INSERT/UPDATE/DELETE when you need the result — without it the step returns an empty array
+- Accessing step result directly instead of via `.data` — database results follow the same envelope as all steps: `sourceData.stepId.data`
+
+## Error Recovery
+
+When a PostgreSQL step fails and the cause is not obvious:
+
+1. **Read the error message** — superglue includes the query text and params in the error. Check for syntax errors, missing columns, or type mismatches.
+2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access to the database, schema, or table. Verify with the user that the credentials have the required grants.
+4. **Test the query directly** — use `sg system call` with a simplified version of the query to isolate whether the issue is the query itself, the parameters, or the connection.
+5. **Check for SSL/TLS issues** — if the error mentions SSL or handshake failure, check the SSL / TLS section above. For non-localhost servers that don't support SSL, add `?sslmode=disable` to the URL. For servers that require SSL, add `?sslmode=require`.

package/dist/skills/superglue/references/redis.md

@@ -1,4 +1,4 @@
-# Redis Steps
+# Redis
 
 ## Step Configuration
 
@@ -11,9 +11,19 @@
 }
 ```
 
-Configure the connection URL depending on which credentials are saved in the stored Redis system - reference them accordingly.
+Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
 
-## URL Format
+`method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for Redis steps.
+
+### Fields
+
+| Field      | Required | Notes                                                          |
+| ---------- | -------- | -------------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
+| `body`     | yes      | JSON: single command object or array for pipeline              |
+| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+
+### URL Format
 
 ```
 redis://user:password@host:port/database
@@ -21,20 +31,18 @@ rediss://user:password@host:port/database   (TLS)
 ```
 
 - `redis://` for standard connections
-- `rediss://` for TLS-encrypted connections (e.g. Redis Cloud, AWS ElastiCache with encryption)
-- `/database` is the database number (defaults to 0 if omitted; max depends on the server's `databases` config, commonly 16)
-
-All credential variables are resolved before connecting. Trailing slashes are cleaned.
+- `rediss://` for TLS-encrypted connections (Redis Cloud, AWS ElastiCache with encryption)
+- `/database` is the database number (defaults to 0; max depends on server config, commonly 16)
 
-## Body Format
+### Body Format
 
-JSON string with `command` (required) and optional `args` array. Body can be a single command object or an array of commands (pipelined in a single round-trip):
+JSON string with `command` (required) and optional `args` array:
 
 ```json
 { "command": "GET", "args": ["mykey"] }
 ```
 
-Multiple commands:
+For pipelines, pass an array of command objects (executed in a single round-trip):
 
 ```json
 [
@@ -43,115 +51,39 @@ Multiple commands:
 ]
 ```
 
-### Common Commands
-
-**String operations:**
-
-```json
-{ "command": "GET", "args": ["user:123:name"] }
-{ "command": "SET", "args": ["user:123:name", "Alice"] }
-{ "command": "MGET", "args": ["key1", "key2", "key3"] }
-{ "command": "INCR", "args": ["counter"] }
-```
+All args must be strings — numbers are auto-coerced.
 
-**Hash operations:**
+Dynamic arguments with variables:
 
 ```json
-{ "command": "HGETALL", "args": ["user:123"] }
-{ "command": "HGET", "args": ["user:123", "email"] }
-{ "command": "HSET", "args": ["user:123", "email", "alice@example.com"] }
-{ "command": "HMGET", "args": ["user:123", "name", "email"] }
+{ "command": "GET", "args": ["<<(sourceData) => `user:${sourceData.userId}:profile`>>"] }
 ```
 
-**List operations:**
-
-```json
-{ "command": "LRANGE", "args": ["queue:tasks", "0", "-1"] }
-{ "command": "LPUSH", "args": ["queue:tasks", "task1"] }
-{ "command": "RPOP", "args": ["queue:tasks"] }
-{ "command": "LLEN", "args": ["queue:tasks"] }
-```
+## Authentication
 
-**Set operations:**
+Credentials are embedded directly in the connection URL using `<<systemId_credentialKey>>` placeholders. Nothing is injected automatically.
 
-```json
-{ "command": "SMEMBERS", "args": ["tags:post:1"] }
-{ "command": "SADD", "args": ["tags:post:1", "redis", "database"] }
-{ "command": "SISMEMBER", "args": ["tags:post:1", "redis"] }
 ```
-
-**Sorted set operations:**
-
-```json
-{ "command": "ZRANGE", "args": ["leaderboard", "0", "-1", "WITHSCORES"] }
-{ "command": "ZADD", "args": ["leaderboard", "100", "player1"] }
-{ "command": "ZRANK", "args": ["leaderboard", "player1"] }
+redis://<<my_redis_username>>:<<my_redis_password>>@<<my_redis_host>>:<<my_redis_port>>/<<my_redis_database>>
 ```
 
-**Key operations:**
+## Redis Runtime Details
 
-```json
-{ "command": "KEYS", "args": ["user:*"] }
-{ "command": "EXISTS", "args": ["mykey"] }
-{ "command": "TTL", "args": ["session:abc"] }
-{ "command": "EXPIRE", "args": ["session:abc", "3600"] }
-{ "command": "DEL", "args": ["mykey"] }
-{ "command": "TYPE", "args": ["mykey"] }
-```
+### Return Values
 
-**Scan (safe iteration):**
+| Command type                 | Returns                                                                                                                                |
+| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET`, `HGET`                | string or null                                                                                                                         |
+| `HGETALL`                    | flat array of alternating field-value pairs, e.g. `["name", "Alice", "email", "alice@example.com"]`. Empty array for non-existent keys |
+| `LRANGE`, `SMEMBERS`, `KEYS` | array of strings                                                                                                                       |
+| `SET`, `DEL`, `EXPIRE`       | `"OK"` or integer                                                                                                                      |
+| `INCR`, `LLEN`, `SADD`       | integer                                                                                                                                |
+| `MGET`, `HMGET`              | array (nulls for missing keys)                                                                                                         |
+| `SCAN`, `HSCAN`              | array of `[cursor, results]`                                                                                                           |
 
-```json
-{ "command": "SCAN", "args": ["0", "MATCH", "user:*", "COUNT", "100"] }
-{ "command": "HSCAN", "args": ["myhash", "0", "MATCH", "field*"] }
-```
+### Pipeline Results
 
-### Dynamic Arguments with Variables
-
-```json
-{ "command": "GET", "args": ["<<(sourceData) => `user:${sourceData.userId}:profile`>>"] }
-```
-
-```json
-{ "command": "HSET", "args": ["<<userKey>>", "<<fieldName>>", "<<fieldValue>>"] }
-```
-
-## Connection Management
-
-- A fresh connection is created per execution and closed after completion
-- TLS auto-configured for `rediss://` URLs (currently uses `rejectUnauthorized: false`)
-- 5-second connection timeout, 30-second command timeout
-- Array commands (pipeline) run on a single connection for efficiency
-
-## Retry Logic
-
-Default retries from server config. On final failure, error includes command and args.
-
-## Return Value
-
-Returns the raw Redis response:
-
-- `GET` / `HGET`: string or null
-- `HGETALL`: flat array of alternating field-value pairs (e.g., `["name", "Alice", "email", "alice@example.com"]`)
-- `LRANGE` / `SMEMBERS` / `KEYS`: array of strings
-- `SET` / `DEL` / `EXPIRE`: "OK" or integer
-- `INCR` / `LLEN` / `SADD`: integer
-- `MGET` / `HMGET`: array (nulls for missing keys)
-- `SCAN` / `HSCAN`: array of [cursor, results]
-
-## Multiple Commands (Pipeline)
-
-Pass an array of commands to execute them in a single round-trip (like FTP/SFTP batch operations):
-
-```json
-[
-  { "command": "GET", "args": ["user:1:name"] },
-  { "command": "HGETALL", "args": ["user:1"] },
-  { "command": "LRANGE", "args": ["tasks", "0", "-1"] }
-]
-```
-
-Returns an array of results, one per command:
+A single command returns a single result. An array of commands returns an array of results:
 
 ```json
 [
@@ -161,18 +93,13 @@ Returns an array of results, one per command:
 ]
 ```
 
-If an individual command fails, that entry has `error` instead of `result`:
+If an individual command in a pipeline fails, that entry has `error` instead of `result`:
 
 ```json
-[
-  { "command": "GET", "result": "Alice" },
-  { "command": "WRONGCMD", "error": "ERR unknown command 'WRONGCMD'" }
-]
+{ "command": "WRONGCMD", "error": "ERR unknown command 'WRONGCMD'" }
 ```
 
-A single command returns a single result. Multiple commands return an array — same pattern as FTP/SFTP operations.
-
-## Batch Operations via Loop
+### Batch Operations
 
 Use a data selector returning an array to execute a command per item:
 
@@ -181,9 +108,32 @@ Use a data selector returning an array to execute a command per item:
 // body: {"command": "HGETALL", "args": ["<<(sourceData) => `user:${sourceData.currentItem}`>>"]}
 ```
 
-## Important Notes
+Prefer array body pipelines over loop-based batch when commands are independent and don't depend on each other's results.
+
+### Connection Management
+
+- Fresh connection created per execution, closed after completion
+- TLS auto-configured for `rediss://` URLs (`rejectUnauthorized: false`)
+- 5-second connection timeout, 30-second command timeout
+- Pipeline commands run on a single connection
+
+### Retry Behavior
+
+Default retries from server config. On final failure, error includes command and args.
+
+## Common Pitfalls
+
+- Using `KEYS` in production on large keyspaces — use `SCAN` with `MATCH` pattern instead
+- Expecting `HGETALL` to return an object — it returns a flat alternating array `[field, value, field, value, ...]`
+- Accessing step result directly instead of via `.data` — Redis results follow the same envelope as all steps: `sourceData.stepId.data`
+- Using separate steps for independent commands that could be pipelined in a single array body
+
+## Error Recovery
+
+When a Redis step fails:
 
-- All args must be strings (Redis protocol is text-based) - numbers are auto-coerced
-- Use `SCAN` instead of `KEYS` in production for large keyspaces
-- `HGETALL` returns an empty array `[]` for non-existent keys
-- Use array body for multi-command pipelines instead of separate steps
+1. **Read the error message** — superglue includes the command and args in the error. Check for unknown commands, wrong argument counts, or type errors (e.g. running a list command on a string key).
+2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `PING` command via `sg system call`.
+3. **Check connectivity and access** — connection refused errors typically mean the Redis server is unreachable or requires TLS (`rediss://`). AUTH errors mean the password is wrong or the user lacks access.
+4. **Check key types** — Redis commands are type-specific. Running `GET` on a hash key or `HGETALL` on a string key returns a `WRONGTYPE` error. Use `TYPE` command via `sg system call` to check a key's type before building.
+5. **Verify TLS requirements** — if the error mentions connection reset or handshake failure, try switching between `redis://` and `rediss://`.

package/dist/skills/superglue/references/sftp-smb.md

@@ -0,0 +1,161 @@
+# SFTP / FTP / SMB
+
+FTP, SFTP, and SMB share an identical operation interface. Only the URL protocol and connection details differ.
+
+## Step Configuration
+
+```typescript
+{
+  type: "request",
+  systemId: "my_sftp_server",
+  url: "sftp://<<my_sftp_server_username>>:<<my_sftp_server_password>>@<<my_sftp_server_host>>:<<my_sftp_server_port>>/basePath",
+  body: '{"operation": "get", "path": "data/report.csv"}'
+}
+```
+
+Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+
+`method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for file server steps.
+
+### Fields
+
+| Field      | Required | Notes                                                          |
+| ---------- | -------- | -------------------------------------------------------------- |
+| `url`      | yes      | Connection string with `<<credential>>` placeholders           |
+| `body`     | yes      | JSON: single operation object or array for batch               |
+| `systemId` | no       | Links system credentials for `<<systemId_credKey>>` resolution |
+
+### URL Formats
+
+```
+ftp://user:password@host:port/basePath       (port 21)
+ftps://user:password@host:port/basePath      (port 21, TLS)
+sftp://user:password@host:port/basePath      (port 22)
+smb://user:password@host/sharename/basePath  (port 445)
+smb://domain\user:password@host/sharename/   (domain auth)
+```
+
+SMB requires a share name as the first path segment. Additional segments become a base path prepended to all operation paths.
+
+### Body Format
+
+JSON string — single operation or array of operations (batch, executed sequentially on a single connection):
+
+```json
+{ "operation": "get", "path": "data/report.csv" }
+```
+
+```json
+[
+  { "operation": "mkdir", "path": "backup" },
+  { "operation": "get", "path": "data/report.csv" },
+  { "operation": "put", "path": "backup/report.csv", "content": "file::report.raw" }
+]
+```
+
+## Authentication
+
+Credentials are embedded in the connection URL using `<<systemId_credentialKey>>` placeholders. Nothing is injected automatically.
+
+```
+sftp://<<my_server_username>>:<<my_server_password>>@host/path
+```
+
+**SFTP private key auth:** use `credentials.privateKey` and `credentials.passphrase` on the system instead of URL password placeholders. Store the private key as a credential on the system.
+
+**SMB domain auth:** use `domain\user` format in the URL, or store `domain` as a system credential.
+
+Only store connection credentials on the system: `host`, `port`, `username`, `password`, `privateKey`, `passphrase`, `domain` (SMB), `home_dir`. Paths and share names belong in the URL, not in credentials.
+
+## File Server Runtime Details
+
+### Path Handling
+
+All operation paths are relative to the base path in the URL. Do not use absolute filesystem paths.
+
+If the system URL is `sftp://user:pass@host/home/sftptest/uploads`:
+
+- `report.csv` resolves to `/home/sftptest/uploads/report.csv`
+- `subdir/data.csv` resolves to `/home/sftptest/uploads/subdir/data.csv`
+
+Do not use `/home/sftptest/uploads/report.csv` — the base path is already set in the URL.
+
+If the URL has no base path (e.g. `sftp://user:pass@host`), paths are used as-is from the server root.
+
+SMB paths use forward slashes — the library handles Windows path conversion internally.
+
+### Operations
+
+| Operation | Required fields   | Returns                                                         |
+| --------- | ----------------- | --------------------------------------------------------------- |
+| `list`    | `path`            | Array of `{ name, path, size, type, modifyTime, ... }`          |
+| `get`     | `path`            | Auto-parsed file content (CSV to objects, JSON to parsed, etc.) |
+| `put`     | `path`, `content` | `{ success, message, size }`                                    |
+| `delete`  | `path`            | `{ success, message }`                                          |
+| `rename`  | `path`, `newPath` | `{ success, message }`                                          |
+| `mkdir`   | `path`            | `{ success, message }`                                          |
+| `rmdir`   | `path`            | `{ success, message }`                                          |
+| `exists`  | `path`            | `{ exists: boolean, path }`                                     |
+| `stat`    | `path`            | File metadata or `{ exists: false }`                            |
+
+### `get` — File Handling
+
+Downloaded files are added to the runtime file store. See `file-handling.md` for detection, parsing, aliasing rules, and the full `file::` reference syntax.
+
+- `data` contains auto-parsed content (CSV to objects, JSON to parsed, PDF to structured, etc.)
+- The step result exposes `stepFileKeys`
+- Later steps reference downloaded files via `file::<stepId>.raw`, `file::<stepId>.base64`, or `file::<stepId>.extracted`
+- Multi-file batch downloads use bracket notation: `file::<stepId>["report.csv"].raw`
+
+### `put` — Content Handling
+
+Use `file::<key>.raw` to preserve original bytes when uploading files from previous steps. See `file-handling.md` for all suffix options.
+
+| Content type                     | Behavior                             |
+| -------------------------------- | ------------------------------------ |
+| `file::<key>.raw` (RawFileBytes) | Written as exact original bytes      |
+| String                           | Written as-is                        |
+| Buffer                           | Written directly                     |
+| Object / Array                   | JSON-stringified with 2-space indent |
+
+### Return Values
+
+Single operation returns the result directly. Array of operations returns an array of results (one per operation, in order).
+
+### Connection Details
+
+**SFTP:** uses `ssh2-sftp-client`. Supports password and private key auth. Connection timeout configurable, default retries from server config.
+
+**FTP/FTPS:** uses `basic-ftp`. FTPS uses TLS with `rejectUnauthorized: false`. Connection timeout configurable.
+
+**SMB:** uses `@tryjsky/v9u-smb2`. Connection lifecycle: create client (with share, domain, credentials), execute operations, disconnect. Entire operation wrapped in a timeout race. For private systems via Secure Gateway, the host is `tunnelId.tunnel` (e.g. `my_tunnel.tunnel`).
+
+### Retry Behavior
+
+Default retries from server config. On final failure, error includes the full operations list. Each retry creates a fresh connection.
+
+### File Output
+
+When the user wants to **download** a file fetched via SFTP/SMB/FTP, set `outputFile: true` on the step. This stores the file in S3 and returns a download link in the API response. Without the flag, fetched files stay internal (only accessible to subsequent steps via `file::` references).
+
+## Common Pitfalls
+
+- Using absolute filesystem paths instead of paths relative to the URL base path
+- Forgetting `outputFile: true` on steps that download files the user wants — without it, the file is only available internally between steps
+- Forgetting that SMB requires a share name as the first URL path segment
+- Using `file::<key>` without a suffix in `put` content. Use `file::<key>.raw` to preserve original bytes
+- Missing the double-data access pattern for `get` results: `sourceData.stepId.data` gives you the parsed file content (through the step envelope)
+- Trying to `put` to a path where intermediate directories don't exist — use `mkdir` first or batch the operations
+
+## Error Recovery
+
+When a file server step fails and the cause is not obvious:
+
+1. **Read the error message** — superglue includes the operations list in the error. Check for typos in paths, missing fields, or unsupported operations.
+2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `list` operation on the base path via `sg system call`.
+3. **Check path resolution** — if you get "file not found", verify the path is relative to the URL base path, not an absolute filesystem path. Use `list` on the parent directory to see what files exist.
+4. **Check permissions** — permission denied errors mean the user account lacks read/write access to the target path. Verify with the user that the account has the required grants.
+5. **Check protocol-specific issues:**
+   - **SFTP**: if the error mentions authentication, verify whether the server expects password or private key auth. If using private key, ensure `privateKey` and `passphrase` are stored as system credentials.
+   - **FTP/FTPS**: if the connection fails, try switching between `ftp://` and `ftps://` — some servers require TLS, others don't support it.
+   - **SMB**: verify the share name is correct (first path segment). If using domain auth, ensure the domain is included in the URL or stored as a credential. Check that the SMB port (445) is accessible.

package/dist/skills/superglue/references/superglue-info.md

@@ -0,0 +1,91 @@
+# superglue Info
+
+## Company
+
+superglue is an open-source, AI-native integration platform that builds and runs deterministic multi-step workflows ("tools") connecting APIs, databases, and file servers. AI generates tool configurations during building — execution is 100% deterministic JavaScript with no LLMs involved.
+
+Developed by superglue (Y Combinator W25), founded by Adina Görres and Stefan Faistenauer in 2025, based in Munich and San Francisco.
+
+- Website: https://superglue.ai
+- Documentation: https://docs.superglue.cloud
+- GitHub: https://github.com/superglue-ai/superglue
+
+If the user is asking general questions (not building):
+
+- Company/team/pricing → https://superglue.ai/
+- Product/features → https://docs.superglue.cloud/getting-started/introduction
+- Open-source/code → https://github.com/superglue-ai/superglue
+
+## Authentication
+
+All superglue interfaces (API, SDK, CLI, MCP) require only an **API key**. Self-hosted deployments also need the API endpoint URL. There are no workspace IDs, project IDs, or other identifiers — the API key is the only credential needed.
+
+Users can generate and manage API keys in **Control Panel → API Keys**. The API endpoint is displayed on the same page.
+
+## Interfaces
+
+- **Web app** — primary UI for building, testing, and managing tools and systems
+- **TypeScript/Python SDK** — https://docs.superglue.cloud/sdk/overview
+- **REST API** — https://docs.superglue.cloud/api-reference/
+- **MCP Server** — https://docs.superglue.cloud/mcp/using-the-mcp
+- **CLI** — `npm install -g @superglue/cli` — https://docs.superglue.cloud/getting-started/cli-skills
+
+### Webhook Triggers
+
+Tools can be triggered via webhook: `POST {apiEndpoint}/v1/hooks/{toolId}?token={apiKey}`
+
+On superglue Cloud, the API endpoint is `https://api.superglue.cloud`. Self-hosted and enterprise deployments use their own API endpoint — users can find theirs under Control Panel → API Keys.
+
+### OAuth Callback URL
+
+OAuth flows require a callback URL: `{appEndpoint}/api/auth/callback`
+
+On superglue Cloud, the app endpoint is `https://app.superglue.cloud`. Self-hosted and enterprise deployments use their own app URL. If a user doesn't know their endpoints, they can check the browser URL bar for the app endpoint, and Control Panel → API Keys for the API endpoint.
+
+## Web App UI Layout
+
+Left sidebar navigation:
+
+- **Agent** — AI chat assistant for building and debugging tools/systems
+- **Landscape** — Visual graph showing all tools and their connected systems
+- **Tools** — List of saved tools. Click a tool to open its playground for editing, testing, and running.
+- **Systems** — List of connected external systems with credentials and documentation
+- **Control Panel** (expandable):
+  - Overview: Dashboard summary
+  - Runs: Execution history for all tool runs with status, errors, and step results
+  - Schedules: Manage scheduled/recurring tool runs
+  - API Keys: View and manage superglue API keys
+  - Organization: Team members and org settings
+  - Notifications: Configure alerts for tool run failures
+- **Docs** — Link to docs.superglue.cloud
+
+## Internals
+
+### Execution Pipeline
+
+`ToolExecutor.execute({ payload, credentials, options })`:
+
+1. **Validate** tool structure (id, steps array, URLs on request steps)
+2. **For each step in order:**
+   a. Build aggregated data: `{ ...originalPayload, ...previousStepResults }`
+   b. Resolve system credentials (refresh OAuth if needed), namespace as `systemId_key`
+   c. Run `dataSelector` → object means single execution, array means loop
+   d. For each item: merge `currentItem` into input and execute
+   e. Wrap result: `{ currentItem, data, success }`
+   f. On failure: abort if `failureBehavior !== "continue"`
+3. **Output transform** (if present): run JS function, validate against outputSchema
+4. **Response filters** (if present): remove/mask/fail on pattern matches
+
+### Strategy Routing
+
+Steps are routed to execution strategies by protocol (first match wins):
+
+1. Transform steps → if `config.type === "transform"`
+2. HTTP → URL starts with `http://` or `https://`
+3. PostgreSQL → URL starts with `postgres://` or `postgresql://`
+4. MSSQL/Azure SQL → URL starts with `mssql://` or `sqlserver://`
+5. Redis → URL starts with `redis://` or `rediss://`
+6. FTP/SFTP → URL starts with `ftp://`, `ftps://`, or `sftp://`
+7. SMB → URL starts with `smb://`
+
+All user-provided JS (data selectors, transforms, stop conditions) runs in an isolated Deno sandbox.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superglue/cli",
-  "version": "1.1.21",
+  "version": "1.1.23",
   "bin": {
     "sg": "./dist/cli.js"
   },