@cursor/bdk 0.2.1

package/dist/internal/cursor-account-mcp-auth.js

@@ -0,0 +1,241 @@
+/**
+ * Service-account connector authorization for
+ * `defineConnection({ cursorAccount: true })` on hosted deployments.
+ *
+ * Hosted engines authenticate as their deployment's dedicated service
+ * account, whose connector OAuth tokens live backend-side. This flow is the
+ * dashboard's Authenticate button as a CLI loop: probe the connectors via
+ * `CheckHttpMcpStatus` (which mints a complete OAuth `authUrl` per connector
+ * needing auth), open each URL for the human to grant, and poll until the
+ * backend reports the token stored. Nothing token-shaped ever touches this
+ * process — the cursor.com callback stores tokens against the service
+ * account. Used by `agent-sdk mcp oauth <connection>` and the post-deploy
+ * hook in `cli-deploy.ts`.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { LOG_PREFIX } from "./distribution.js";
+import { openBrowser } from "./mcp-oauth.js";
+import { sleep as defaultSleep } from "./sleep.js";
+const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/** Same default the dashboard uses; MCP_OAUTH_REDIRECT_URI overrides for dev. */
+export function mcpOauthRedirectUri() {
+    const override = process.env.MCP_OAUTH_REDIRECT_URI;
+    if (override !== undefined && override.trim() !== "") {
+        return override.trim();
+    }
+    return "https://www.cursor.com/agents/mcp/oauth/callback";
+}
+/**
+ * Authorize the deployment service account for the connection's connectors.
+ * Already-authorized connectors are skipped; the rest get a browser OAuth
+ * each (sequentially), polled until the backend stores the token.
+ */
+export function authorizeCursorAccountConnectors(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        const { backendClient, teamId, serviceAccountId, connectionName, out, err } = args;
+        const open = (_a = args.openBrowserImpl) !== null && _a !== void 0 ? _a : openBrowser;
+        const sleep = (_b = args.sleep) !== null && _b !== void 0 ? _b : defaultSleep;
+        const pollIntervalMs = (_c = args.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS;
+        const pollTimeoutMs = (_d = args.pollTimeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_POLL_TIMEOUT_MS;
+        const redirectUri = mcpOauthRedirectUri();
+        // Team-scoped connectors only: the hosted bridge resolves the SA's team
+        // servers, so personal connectors can never apply to a deployment.
+        const available = (yield backendClient.getAvailableMcpServers({ teamId })).filter(server => server.isTeamServer);
+        const selected = selectConnectors(available, args.servers);
+        for (const missing of selected.unmatched) {
+            err(`${LOG_PREFIX} Connection "${connectionName}" lists connector ${JSON.stringify(missing)}, but the team has no such connector (dashboard → MCP).\n`);
+        }
+        if (selected.servers.length === 0) {
+            err(`${LOG_PREFIX} No matching team connectors for connection "${connectionName}".\n`);
+            return { authorized: [], pending: [], errored: [] };
+        }
+        const nameById = new Map(selected.servers.map(server => [server.id, server.name]));
+        const statuses = yield backendClient.checkHttpMcpStatus({
+            serverIds: selected.servers.map(server => server.id),
+            oauthRedirectUri: redirectUri,
+            serviceAccountId,
+        });
+        const result = {
+            authorized: [],
+            pending: [],
+            errored: [],
+        };
+        for (const status of statuses) {
+            const name = (_e = nameById.get(status.id)) !== null && _e !== void 0 ? _e : `#${status.id}`;
+            if (!status.requiresAuth) {
+                if (status.error !== undefined && status.error !== "") {
+                    err(`${LOG_PREFIX} ${name}: ${status.error}\n`);
+                    result.errored.push({ name, error: status.error });
+                    continue;
+                }
+                out(`${LOG_PREFIX} ${name}: already authorized ✓\n`);
+                result.authorized.push(name);
+                continue;
+            }
+            if (status.authUrl === undefined || status.authUrl === "") {
+                const error = (_f = status.error) !== null && _f !== void 0 ? _f : "no authorization URL was minted";
+                err(`${LOG_PREFIX} ${name}: ${error}\n`);
+                result.errored.push({ name, error });
+                continue;
+            }
+            if (!args.interactive) {
+                result.pending.push(name);
+                continue;
+            }
+            out(`${LOG_PREFIX} ${name}: authorization needed. You'll authorize ${name} as yourself; ` +
+                `anyone who can talk to this agent can act with that access.\n` +
+                `${LOG_PREFIX} Opening (or open manually):\n  ${status.authUrl}\n`);
+            open(status.authUrl);
+            const authorized = yield pollUntilAuthorized({
+                backendClient,
+                serverId: status.id,
+                serviceAccountId,
+                redirectUri,
+                sleep,
+                pollIntervalMs,
+                pollTimeoutMs,
+            });
+            if (authorized) {
+                out(`${LOG_PREFIX} ${name}: authorized ✓\n`);
+                result.authorized.push(name);
+            }
+            else {
+                err(`${LOG_PREFIX} ${name}: still waiting on authorization; giving up for now.\n`);
+                result.pending.push(name);
+            }
+        }
+        return result;
+    });
+}
+function selectConnectors(available, filter) {
+    if (filter === undefined || filter.length === 0) {
+        return { servers: available, unmatched: [] };
+    }
+    const servers = [];
+    const seen = new Set();
+    const unmatched = [];
+    for (const name of filter) {
+        const wanted = name.trim().toLowerCase();
+        const matches = available.filter(server => { var _a; return server.name.toLowerCase() === wanted || ((_a = server.serverIdentifier) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === wanted; });
+        if (matches.length === 0) {
+            unmatched.push(name);
+            continue;
+        }
+        for (const match of matches) {
+            if (!seen.has(match.id)) {
+                seen.add(match.id);
+                servers.push(match);
+            }
+        }
+    }
+    return { servers, unmatched };
+}
+function uniqueConnectorMatch(available, identifier) {
+    const wanted = identifier.trim().toLowerCase();
+    if (wanted === "") {
+        return undefined;
+    }
+    const byIdentifier = available.filter(server => { var _a; return ((_a = server.serverIdentifier) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === wanted; });
+    if (byIdentifier.length === 1) {
+        return byIdentifier[0];
+    }
+    if (byIdentifier.length > 1) {
+        return undefined;
+    }
+    const byName = available.filter(server => server.name.toLowerCase() === wanted);
+    if (byName.length === 1) {
+        return byName[0];
+    }
+    return undefined;
+}
+/**
+ * Mint OAuth `authUrl`s for connectors matching `identifiers` (name or
+ * `serverIdentifier`). Omit `serviceAccountId` to probe the signed-in user
+ * (local `serve` preflight). Failures return an empty map so the caller
+ * can fall back to the dashboard URL.
+ */
+export function probeConnectorAuthUrls(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const urls = new Map();
+        if (args.identifiers.length === 0) {
+            return urls;
+        }
+        try {
+            const available = yield args.client.getAvailableMcpServers();
+            const matched = [];
+            const seen = new Set();
+            for (const identifier of args.identifiers) {
+                const match = uniqueConnectorMatch(available, identifier);
+                if (match === undefined || seen.has(match.id)) {
+                    continue;
+                }
+                seen.add(match.id);
+                matched.push(match);
+            }
+            if (matched.length === 0) {
+                return urls;
+            }
+            const statuses = yield args.client.checkHttpMcpStatus({
+                serverIds: matched.map(server => server.id),
+                oauthRedirectUri: mcpOauthRedirectUri(),
+                serviceAccountId: args.serviceAccountId,
+            });
+            const statusById = new Map(statuses.map(status => [status.id, status]));
+            for (const identifier of args.identifiers) {
+                const match = uniqueConnectorMatch(available, identifier);
+                if (match === undefined) {
+                    continue;
+                }
+                const authUrl = (_b = (_a = statusById.get(match.id)) === null || _a === void 0 ? void 0 : _a.authUrl) === null || _b === void 0 ? void 0 : _b.trim();
+                if (authUrl !== undefined && authUrl !== "") {
+                    urls.set(identifier, authUrl);
+                }
+            }
+            return urls;
+        }
+        catch (_c) {
+            return urls;
+        }
+    });
+}
+function pollUntilAuthorized(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const deadline = Date.now() + args.pollTimeoutMs;
+        // Each unauthorized probe is a full backend connect to the provider, so
+        // back off while the human works through the OAuth pages.
+        let intervalMs = args.pollIntervalMs;
+        const maxIntervalMs = Math.max(args.pollIntervalMs, 15000);
+        while (Date.now() < deadline) {
+            yield args.sleep(intervalMs);
+            intervalMs = Math.min(intervalMs * 1.5, maxIntervalMs);
+            let statuses;
+            try {
+                statuses = yield args.backendClient.checkHttpMcpStatus({
+                    serverIds: [args.serverId],
+                    oauthRedirectUri: args.redirectUri,
+                    serviceAccountId: args.serviceAccountId,
+                });
+            }
+            catch (_a) {
+                // Transient probe errors; keep polling until the deadline.
+                continue;
+            }
+            const status = statuses.find(entry => entry.id === args.serverId);
+            if (status !== undefined && !status.requiresAuth) {
+                return true;
+            }
+        }
+        return false;
+    });
+}

package/dist/internal/cursor-agent-template.d.ts

@@ -0,0 +1,9 @@
+declare const TEMPLATE_NAMES: readonly ["agentic-owners", "agents-md", "code-wiki", "demo", "grokbot-agents", "pr-autofixer", "security-help", "security-reviewer", "thermo-quality-review", "thermo-review", "triage-linear", "triage-jira"];
+export type TemplateName = (typeof TEMPLATE_NAMES)[number];
+export declare function canonicalTemplateName(name: string): string;
+export declare function isTemplateName(name: string): name is TemplateName;
+/** Raw scaffold marker. Validation depends on the consuming boundary. */
+export declare function readCursorAgentTemplate(rootDir: string): string | undefined;
+export declare function readDeployTemplate(rootDir: string): string | undefined;
+export {};
+//# sourceMappingURL=cursor-agent-template.d.ts.map

package/dist/internal/cursor-agent-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-agent-template.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-agent-template.ts"],"names":[],"mappings":"AAIA,QAAA,MAAM,cAAc,YAClB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,aAAa,CACL,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAG3D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAU3E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtE"}

package/dist/internal/cursor-agent-template.js

@@ -0,0 +1,43 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+const MAX = 64;
+const TEMPLATE_NAMES = [
+    "agentic-owners",
+    "agents-md",
+    "code-wiki",
+    "demo",
+    "grokbot-agents",
+    "pr-autofixer",
+    "security-help",
+    "security-reviewer",
+    "thermo-quality-review",
+    "thermo-review",
+    "triage-linear",
+    "triage-jira",
+];
+const NAMES = new Set(TEMPLATE_NAMES);
+export function canonicalTemplateName(name) {
+    return name === "triage" ? "triage-linear" : name;
+}
+export function isTemplateName(name) {
+    return NAMES.has(name);
+}
+/** Raw scaffold marker. Validation depends on the consuming boundary. */
+export function readCursorAgentTemplate(rootDir) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(rootDir, "package.json"), "utf8"));
+        const stamp = pkg.cursorAgentTemplate;
+        return typeof stamp === "string" ? stamp : undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
+export function readDeployTemplate(rootDir) {
+    const stamp = readCursorAgentTemplate(rootDir);
+    if (stamp === undefined || stamp.length === 0 || stamp.length > MAX) {
+        return undefined;
+    }
+    const name = canonicalTemplateName(stamp);
+    return isTemplateName(name) ? name : undefined;
+}

package/dist/internal/cursor-deployment-relay.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Pull relay for `/v0/deployment-events`.
+ *
+ * A {@link RelayAdapter} over {@link CursorRelayCore} — the same engine the
+ * GitHub SCM and Slack relays use, so registration heartbeats, durable
+ * offsets, backoff, and bounded dispatch retry are inherited rather than
+ * reimplemented. Only the subscribe/poll paths, the registration body, and
+ * the per-event filter differ.
+ */
+import type { DeploymentEvent, DeploymentEventType, DeploymentSubscription } from "../channels/deployments/types.js";
+/** One page entry: the event fields plus its stream offset, as the sibling
+ * providers spell it. */
+export type DeploymentRelayEvent = DeploymentEvent & {
+    offset: string;
+};
+export interface ResolvedSubscription {
+    deploySourceUri: string;
+    environments: string[];
+    events: Set<DeploymentEventType>;
+}
+export type DeploymentSubscriptionSource = readonly ResolvedSubscription[] | (() => readonly ResolvedSubscription[]);
+export interface DeploymentEventRelayOptions {
+    baseUrl: string;
+    apiKey: string;
+    stateDir: string;
+    /**
+     * Snapshot or a getter. A getter is re-read on every registration
+     * heartbeat so a channel that refreshes `deploySourceUris` after start
+     * can add sources without restarting the relay.
+     */
+    subscriptions: DeploymentSubscriptionSource;
+    dispatch: (event: DeploymentEvent) => Promise<void>;
+    logger: (line: string) => void;
+    fetchImpl?: typeof fetch;
+    pollWaitMs?: number;
+}
+/** Current subscriptions: a live getter, otherwise the snapshot. */
+export declare function currentDeploymentSubscriptions(subscriptions: DeploymentSubscriptionSource): readonly ResolvedSubscription[];
+/**
+ * Normalize the channel's `deploySourceUris` option into concrete
+ * subscriptions. An omitted or empty option resolves to none, which callers
+ * read as "defer to the deploy scope".
+ */
+export declare function resolveDeploymentSubscriptions(options: {
+    deploySourceUris?: readonly (string | DeploymentSubscription)[];
+    environments?: readonly string[];
+    events?: readonly DeploymentEventType[];
+}): ResolvedSubscription[];
+/**
+ * Union per-channel subscriptions, widening events and environments when
+ * the same deploy source appears more than once. An empty environment
+ * list means every environment and absorbs a narrower list.
+ */
+export declare function mergeResolvedSubscriptions(groups: readonly (readonly ResolvedSubscription[])[]): ResolvedSubscription[];
+/** Whether one confirmed subscription wants this event. */
+export declare function deploymentEventMatches(subscription: ResolvedSubscription, envelope: DeploymentEvent): boolean;
+/** One channel the host can deliver a deployment event to. */
+export interface DeploymentDispatchTarget {
+    /** Display name for logs, e.g. `executor/deployments`. */
+    name: string;
+    subscriptions: readonly ResolvedSubscription[];
+    deliver: (event: DeploymentEvent) => Promise<unknown>;
+}
+/**
+ * Deliver one event to every channel subscribed to it.
+ *
+ * Each channel is delivered independently: one channel's handler throwing
+ * must not skip the channels after it, because the relay core retries the
+ * whole dispatch and the channels that already ran would see the event twice.
+ * Throws only when every subscribed channel failed, so a retry cannot
+ * re-deliver to a channel that succeeded.
+ */
+export declare function fanOutDeploymentEvent(input: {
+    targets: readonly DeploymentDispatchTarget[];
+    event: DeploymentEvent;
+    logger: (line: string) => void;
+}): Promise<void>;
+export declare class DeploymentEventRelay {
+    private readonly options;
+    private readonly core;
+    private subscribed;
+    private readonly loggedSkippedSources;
+    constructor(options: DeploymentEventRelayOptions);
+    /**
+     * Whether an event from this principal's stream belongs to THIS relay.
+     * The stream is per-principal, and one API key can back several relays
+     * (other hosts, or an agent running its own alongside the host's), so each
+     * one re-checks the events against the subscriptions the server confirmed
+     * for it.
+     */
+    private shouldDispatch;
+    start(): void;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=cursor-deployment-relay.d.ts.map

package/dist/internal/cursor-deployment-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,MAAM,4BAA4B,GACpC,SAAS,oBAAoB,EAAE,GAC/B,CAAC,MAAM,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,4BAA4B,GAC1C,SAAS,oBAAoB,EAAE,CAEjC;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAChE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA4CzB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACnD,oBAAoB,EAAE,CAqBxB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAyDhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}

package/dist/internal/cursor-deployment-relay.js

@@ -0,0 +1,233 @@
+/**
+ * Pull relay for `/v0/deployment-events`.
+ *
+ * A {@link RelayAdapter} over {@link CursorRelayCore} — the same engine the
+ * GitHub SCM and Slack relays use, so registration heartbeats, durable
+ * offsets, backoff, and bounded dispatch retry are inherited rather than
+ * reimplemented. Only the subscribe/poll paths, the registration body, and
+ * the per-event filter differ.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { CursorRelayCore } from "./cursor-relay-core.js";
+const DEFAULT_EVENTS = ["deployment.succeeded"];
+/** Current subscriptions: a live getter, otherwise the snapshot. */
+export function currentDeploymentSubscriptions(subscriptions) {
+    return typeof subscriptions === "function" ? subscriptions() : subscriptions;
+}
+/**
+ * Normalize the channel's `deploySourceUris` option into concrete
+ * subscriptions. An omitted or empty option resolves to none, which callers
+ * read as "defer to the deploy scope".
+ */
+export function resolveDeploymentSubscriptions(options) {
+    var _a, _b, _c, _d, _e;
+    const bySource = new Map();
+    for (const entry of (_a = options.deploySourceUris) !== null && _a !== void 0 ? _a : []) {
+        const subscription = typeof entry === "string" ? { deploySourceUri: entry } : entry;
+        // Case-folded only: `Deployment.deploy_source_uri` has no documented
+        // format, and the server keys subscriptions the same way.
+        const deploySourceUri = subscription.deploySourceUri.trim().toLowerCase();
+        if (deploySourceUri === "") {
+            throw new Error(`deploymentsChannel: invalid deploy source "${subscription.deploySourceUri}".`);
+        }
+        const environments = [
+            ...new Set(((_c = (_b = subscription.environments) !== null && _b !== void 0 ? _b : options.environments) !== null && _c !== void 0 ? _c : [])
+                .map(value => value.trim())
+                .filter(Boolean)),
+        ];
+        const events = new Set((_e = (_d = subscription.events) !== null && _d !== void 0 ? _d : options.events) !== null && _e !== void 0 ? _e : DEFAULT_EVENTS);
+        if (events.size === 0) {
+            throw new Error(`deploymentsChannel: deploy source "${deploySourceUri}" subscribes to no events.`);
+        }
+        // Later entries for the same deploy source widen the earlier one rather
+        // than silently replacing it.
+        const existing = bySource.get(deploySourceUri);
+        if (existing === undefined) {
+            bySource.set(deploySourceUri, { deploySourceUri, environments, events });
+            continue;
+        }
+        for (const event of events)
+            existing.events.add(event);
+        existing.environments =
+            existing.environments.length === 0 || environments.length === 0
+                ? []
+                : [...new Set([...existing.environments, ...environments])];
+    }
+    // Empty means "this channel names nothing". The relay wire reads that as
+    // deregistration, hosted admission reads it as "defer to the deploy
+    // scope". The host re-resolves on each heartbeat, so a channel that later
+    // fills `deploySourceUris` registers without a restart.
+    return [...bySource.values()];
+}
+/**
+ * Union per-channel subscriptions, widening events and environments when
+ * the same deploy source appears more than once. An empty environment
+ * list means every environment and absorbs a narrower list.
+ */
+export function mergeResolvedSubscriptions(groups) {
+    const bySource = new Map();
+    for (const group of groups) {
+        for (const subscription of group) {
+            const existing = bySource.get(subscription.deploySourceUri);
+            if (existing === undefined) {
+                bySource.set(subscription.deploySourceUri, {
+                    deploySourceUri: subscription.deploySourceUri,
+                    environments: [...subscription.environments],
+                    events: new Set(subscription.events),
+                });
+                continue;
+            }
+            for (const event of subscription.events)
+                existing.events.add(event);
+            existing.environments =
+                existing.environments.length === 0 || subscription.environments.length === 0
+                    ? []
+                    : [...new Set([...existing.environments, ...subscription.environments])];
+        }
+    }
+    return [...bySource.values()];
+}
+/** Whether one confirmed subscription wants this event. */
+export function deploymentEventMatches(subscription, envelope) {
+    if (!subscription.events.has(envelope.eventType)) {
+        return false;
+    }
+    return (subscription.environments.length === 0 ||
+        subscription.environments.includes(envelope.environment));
+}
+/**
+ * Deliver one event to every channel subscribed to it.
+ *
+ * Each channel is delivered independently: one channel's handler throwing
+ * must not skip the channels after it, because the relay core retries the
+ * whole dispatch and the channels that already ran would see the event twice.
+ * Throws only when every subscribed channel failed, so a retry cannot
+ * re-deliver to a channel that succeeded.
+ */
+export function fanOutDeploymentEvent(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { event, logger } = input;
+        const matched = input.targets.filter(target => target.subscriptions.some(subscription => subscription.deploySourceUri === event.deploySourceUri &&
+            deploymentEventMatches(subscription, event)));
+        const failures = [];
+        for (const target of matched) {
+            try {
+                yield target.deliver(event);
+            }
+            catch (error) {
+                failures.push(target.name);
+                logger(`[agent-sdk] deployment-events: ${target.name} failed on ${event.eventId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        logger(`[agent-sdk] deployment-events: ${event.eventType} ${event.deploySourceUri}@${event.deployVersion} (${event.environment}) → ${matched.length - failures.length}/${matched.length} channel(s)`);
+        if (failures.length > 0 && failures.length === matched.length) {
+            throw new Error(`deployment-events: every subscribed channel failed on ${event.eventId} (${failures.join(", ")})`);
+        }
+    });
+}
+export class DeploymentEventRelay {
+    constructor(options) {
+        this.options = options;
+        this.subscribed = new Map();
+        this.loggedSkippedSources = new Set();
+        const adapter = {
+            logPrefix: "deployment-events",
+            subscribePath: "/v0/deployment-events/subscriptions",
+            pollPath: "/v0/deployment-events",
+            buildRegistrationBody: consumerId => ({
+                consumerId,
+                subscriptions: currentDeploymentSubscriptions(options.subscriptions).map(subscription => ({
+                    deploySourceUri: subscription.deploySourceUri,
+                    environments: subscription.environments,
+                    events: [...subscription.events],
+                })),
+            }),
+            // Empty subscriptions drop this consumer's registration on clean stop
+            // instead of leaving it to lapse by TTL.
+            buildDeregistrationBody: consumerId => ({
+                consumerId,
+                subscriptions: [],
+            }),
+            applyRegistrationResponse: json => {
+                var _a, _b;
+                const result = json;
+                const wantedSubscriptions = currentDeploymentSubscriptions(options.subscriptions);
+                this.subscribed = new Map();
+                this.loggedSkippedSources.clear();
+                const lines = [];
+                const confirmed = [];
+                for (const status of (_a = result.deploySourceUris) !== null && _a !== void 0 ? _a : []) {
+                    const wanted = wantedSubscriptions.find(subscription => subscription.deploySourceUri === status.deploySourceUri);
+                    if (!status.isSubscribed || wanted === undefined) {
+                        lines.push(`not subscribed to ${status.deploySourceUri}: ${(_b = status.detail) !== null && _b !== void 0 ? _b : "unknown reason"}`);
+                        continue;
+                    }
+                    this.subscribed.set(status.deploySourceUri, wanted);
+                    confirmed.push(status.deploySourceUri);
+                }
+                if (confirmed.length > 0) {
+                    const kinds = [...new Set(wantedSubscriptions.flatMap(s => [...s.events]))];
+                    lines.push(`subscribed to ${confirmed.join(", ")} for events: ${kinds.join(", ")}`);
+                }
+                return lines;
+            },
+            shouldDispatch: event => this.shouldDispatch(event),
+            dispatch: (_a) => {
+                var { offset: _offset } = _a, envelope = __rest(_a, ["offset"]);
+                return options.dispatch(envelope);
+            },
+        };
+        this.core = new CursorRelayCore(Object.assign(Object.assign({ baseUrl: options.baseUrl, apiKey: options.apiKey, stateDir: options.stateDir, adapter, logger: options.logger }, (options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl })), (options.pollWaitMs === undefined ? {} : { pollWaitMs: options.pollWaitMs })));
+    }
+    /**
+     * Whether an event from this principal's stream belongs to THIS relay.
+     * The stream is per-principal, and one API key can back several relays
+     * (other hosts, or an agent running its own alongside the host's), so each
+     * one re-checks the events against the subscriptions the server confirmed
+     * for it.
+     */
+    shouldDispatch(event) {
+        const envelope = event;
+        if (envelope === null ||
+            typeof envelope !== "object" ||
+            typeof envelope.deploySourceUri !== "string") {
+            return false;
+        }
+        const subscription = this.subscribed.get(envelope.deploySourceUri);
+        if (subscription === undefined) {
+            if (!this.loggedSkippedSources.has(envelope.deploySourceUri)) {
+                this.loggedSkippedSources.add(envelope.deploySourceUri);
+                this.options.logger(`[agent-sdk] deployment-events: skipping events for ${envelope.deploySourceUri}: not in this host's subscription (another consumer of this API key likely subscribed it)`);
+            }
+            return false;
+        }
+        return deploymentEventMatches(subscription, envelope);
+    }
+    start() {
+        this.core.start();
+    }
+    stop() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.core.stop();
+        });
+    }
+}