@cursor/bdk 0.2.23 → 0.2.25

package/dist/channels.js

@@ -8,7 +8,7 @@
  *
  * ```ts
  * import { defineChannel, POST } from "@cursor/bdk/channels";
- * import { z } from "zod";
+ * import { z } from "zod/v3";
  *
  * export default defineChannel({
  *   routes: [
@@ -46,8 +46,9 @@
  */
 export { openCiCheck, resumeCiCheck, } from "./channels/checks.js";
 import { Buffer } from "node:buffer";
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { timingSafeEqual } from "node:crypto";
 import { brandDefinition } from "./internal/brand.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "./internal/hmac-secret-values.js";
 import { attachCatchAdmission } from "./internal/hosted-catch.js";
 import { isLoopbackAddress, isLoopbackHostname } from "./internal/net.js";
 /** Configure the built-in HTTP session channel at `agent/channels/http.ts`. */
@@ -368,27 +369,40 @@ export function sharedSecretAuth(options) {
         secret: options.secret,
     });
 }
+const MAX_HMAC_SEPARATOR_LENGTH = 8;
 /**
  * Admit requests whose `header` carries the hex HMAC-SHA256 of the raw body
  * under the secret named `secret` (optionally behind a literal `prefix`
  * such as `sha256=`). Same local / hosted / catch semantics as
  * {@link sharedSecretAuth}.
+ *
+ * Set `separator` for providers that send several signatures in one header
+ * while a secret rotates, e.g. PagerDuty's
+ * `X-PagerDuty-Signature: v1=<hex>,v1=<hex>` with `prefix: "v1="` and
+ * `separator: ","`. The request is admitted when any entry matches.
+ *
+ * The named secret may hold several signing secrets, one per line (for
+ * example one per provider subscription, or old and new during a
+ * rotation); any of them verifies. Lines are trimmed and blank lines
+ * ignored, a value with no line break is one secret used as-is, and a
+ * value holding more secrets than the cap admits nothing.
  */
 export function hmacSignatureAuth(options) {
     const header = options.header.toLowerCase();
     const prefix = options.prefix ?? "";
+    const separator = options.separator;
+    if (separator !== undefined &&
+        (separator.length === 0 || separator.length > MAX_HMAC_SEPARATOR_LENGTH)) {
+        throw new Error(`hmacSignatureAuth separator must be 1-${MAX_HMAC_SEPARATOR_LENGTH} characters.`);
+    }
     const policy = async (request) => {
-        const secret = process.env[options.secret];
+        const parsed = parseHmacSecrets(process.env[options.secret]);
         const presented = request.headers.get(header)?.trim();
-        if (secret === undefined ||
-            secret.length === 0 ||
-            presented === undefined ||
-            !presented.startsWith(prefix)) {
+        if (!parsed.ok || presented === undefined) {
             return null;
         }
         const body = Buffer.from(await request.clone().arrayBuffer());
-        const expected = createHmac("sha256", secret).update(body).digest("hex");
-        if (!constantTimeEquals(presented.slice(prefix.length).toLowerCase(), expected)) {
+        if (!hmacSignatureMatchesAny({ body, presented, secrets: parsed.secrets, prefix, separator })) {
             return null;
         }
         return {
@@ -402,5 +416,6 @@ export function hmacSignatureAuth(options) {
         header,
         secret: options.secret,
         prefix: options.prefix,
+        separator,
     });
 }

package/dist/docs/404.html

@@ -6,10 +6,10 @@
     <title>404 | Bot Development Kit (BDK)</title>
     <meta name="description" content="Not Found">
     <meta name="generator" content="VitePress v1.6.4">
-    <link rel="preload stylesheet" href="/docs/assets/style.Dwls12uf.css" as="style">
+    <link rel="preload stylesheet" href="/docs/assets/style.nMsabY-V.css" as="style">
     <link rel="preload stylesheet" href="/docs/vp-icons.css" as="style">
     
-    <script type="module" src="/docs/assets/app.AXQcJZaf.js"></script>
+    <script type="module" src="/docs/assets/app.BjS1QEI4.js"></script>
     <link rel="preload" href="/docs/assets/inter-roman-latin.Di8DUHzh.woff2" as="font" type="font/woff2" crossorigin="">
     <script id="check-dark-mode">(()=>{const e=localStorage.getItem("vitepress-theme-appearance")||"auto",a=window.matchMedia("(prefers-color-scheme: dark)").matches;(!e||e==="auto"?a:e==="dark")&&document.documentElement.classList.add("dark")})();</script>
     <script id="check-mac-os">document.documentElement.classList.toggle("mac",/Mac|iPhone|iPod|iPad/i.test(navigator.platform));</script>
@@ -18,7 +18,7 @@
   </head>
   <body>
     <div id="app"></div>
-    <script>window.__VP_HASH_MAP__=JSON.parse("{\"building-with-agents.md\":\"FZXrY8Nk\",\"deployment.md\":\"CtSJ6sF9\",\"evals.md\":\"CHR34K1Y\",\"guides_agent-to-agent.md\":\"CwL5cwuE\",\"guides_bitbucket.md\":\"CKUayYtD\",\"guides_cloud-agents.md\":\"CBK7W0-O\",\"guides_convert-automation.md\":\"DMEX9nF-\",\"guides_export-grokbot.md\":\"qo5bxi4h\",\"guides_github.md\":\"TuNiZAOQ\",\"guides_gitlab.md\":\"CtNI4fSH\",\"guides_grokbot-agents.md\":\"BwAykJ7U\",\"guides_hooks.md\":\"Bfj0pK91\",\"guides_improve.md\":\"CZKVt1cT\",\"guides_jev.md\":\"D7XH4JH3\",\"guides_mcp-oauth.md\":\"BM_eFC0L\",\"guides_migrate.md\":\"CQlGaBKX\",\"guides_opentelemetry.md\":\"ByW1Fs7b\",\"guides_slack.md\":\"Bn-WupSE\",\"guides_webhooks.md\":\"Cpdc3BDX\",\"hillclimbing.md\":\"Dxvd-0gT\",\"index.md\":\"CAnsLl8D\",\"quickstart.md\":\"D8JDfkKO\",\"reference_agent-config.md\":\"DYA6ge6t\",\"reference_artifacts.md\":\"DLV9MZES\",\"reference_channels.md\":\"DYg0CLud\",\"reference_cli.md\":\"DB7Llw3T\",\"reference_connections.md\":\"BJE2Zllp\",\"reference_evals.md\":\"Ccwp4x3o\",\"reference_extensions.md\":\"OUacPetl\",\"reference_hooks.md\":\"B1jq3oGl\",\"reference_http-api.md\":\"Dji-DD_Z\",\"reference_instructions.md\":\"DrcHZXig\",\"reference_memory.md\":\"BwyJXYZe\",\"reference_playground.md\":\"q4MI-0td\",\"reference_project-layout.md\":\"mFcS8yDD\",\"reference_prompt.md\":\"DqPh71XN\",\"reference_schedules.md\":\"BqWnJES4\",\"reference_sessions.md\":\"C8FXuGwk\",\"reference_skills.md\":\"C2GWh7g8\",\"reference_subagents.md\":\"ChNGh6HK\",\"reference_tools.md\":\"08XR7lIl\",\"templates_agentic-owners.md\":\"CvmABtia\",\"templates_grokbot-agents.md\":\"DgpPEs7B\",\"templates_security-reviewer.md\":\"Gh6EF9Us\",\"templates_thermo-quality-review.md\":\"B77UyTrX\",\"templates_thermo-review.md\":\"DRJ7mC5U\",\"templates_triage.md\":\"CNN6b0JZ\",\"troubleshooting.md\":\"DFnoTDlQ\"}");window.__VP_SITE_DATA__=JSON.parse("{\"lang\":\"en-US\",\"dir\":\"ltr\",\"title\":\"Bot Development Kit (BDK)\",\"description\":\"Build and serve bots and agents from versioned Markdown and TypeScript.\",\"base\":\"/docs/\",\"head\":[],\"router\":{\"prefetchLinks\":true},\"appearance\":true,\"themeConfig\":{\"sdkVersion\":\"0.2.23\",\"nav\":[{\"text\":\"Quickstart\",\"link\":\"/quickstart\"},{\"text\":\"Guides\",\"link\":\"/guides/mcp-oauth\"},{\"text\":\"Integrations\",\"link\":\"/guides/github\"},{\"text\":\"Templates\",\"link\":\"/templates/security-reviewer\"},{\"text\":\"Reference\",\"link\":\"/reference/project-layout\"}],\"search\":{\"provider\":\"local\"},\"outline\":{\"level\":[2,3]},\"sidebar\":[{\"text\":\"Getting started\",\"items\":[{\"text\":\"Overview\",\"link\":\"/\"},{\"text\":\"Building your first agent\",\"link\":\"/quickstart\"}]},{\"text\":\"Integrations\",\"collapsed\":false,\"items\":[{\"text\":\"GitHub\",\"link\":\"/guides/github\"},{\"text\":\"Slack\",\"link\":\"/guides/slack\"},{\"text\":\"Webhooks\",\"link\":\"/guides/webhooks\"},{\"text\":\"Cursor Automations\",\"link\":\"/guides/convert-automation\"},{\"text\":\"OpenTelemetry\",\"link\":\"/guides/opentelemetry\"},{\"text\":\"GitLab\",\"link\":\"/guides/gitlab\"},{\"text\":\"Bitbucket\",\"link\":\"/guides/bitbucket\"}]},{\"text\":\"Extensions\",\"collapsed\":false,\"items\":[{\"text\":\"Overview\",\"link\":\"/reference/extensions\"},{\"text\":\"Cloud agents\",\"link\":\"/guides/cloud-agents\"},{\"text\":\"Grok Bot agents\",\"link\":\"/guides/grokbot-agents\"},{\"text\":\"Self-improvement\",\"link\":\"/guides/improve\"},{\"text\":\"Jev\",\"link\":\"/guides/jev\"}]},{\"text\":\"Guides\",\"collapsed\":false,\"items\":[{\"text\":\"MCP\",\"link\":\"/guides/mcp-oauth\"},{\"text\":\"Hooks\",\"link\":\"/guides/hooks\"},{\"text\":\"Peer agents\",\"link\":\"/guides/agent-to-agent\"},{\"text\":\"Deployment\",\"link\":\"/deployment\"},{\"text\":\"Export a Grok Bot\",\"link\":\"/guides/export-grokbot\"},{\"text\":\"Early-alpha migration\",\"link\":\"/guides/migrate\"},{\"text\":\"Evals\",\"link\":\"/evals\"},{\"text\":\"Hillclimbing\",\"link\":\"/hillclimbing\"},{\"text\":\"Build with a coding agent\",\"link\":\"/building-with-agents\"},{\"text\":\"Troubleshooting\",\"link\":\"/troubleshooting\"}]},{\"text\":\"Templates\",\"collapsed\":false,\"items\":[{\"text\":\"Grok Bot agents\",\"link\":\"/templates/grokbot-agents\"},{\"text\":\"Security reviewer\",\"link\":\"/templates/security-reviewer\"},{\"text\":\"Thermo review\",\"link\":\"/templates/thermo-review\"},{\"text\":\"Thermo quality review\",\"link\":\"/templates/thermo-quality-review\"},{\"text\":\"Agentic Approver\",\"link\":\"/templates/agentic-owners\"},{\"text\":\"Triage agent\",\"link\":\"/templates/triage\"}]},{\"text\":\"Reference\",\"collapsed\":false,\"items\":[{\"text\":\"Project layout\",\"link\":\"/reference/project-layout\"},{\"text\":\"Agent config\",\"link\":\"/reference/agent-config\"},{\"text\":\"Instructions\",\"link\":\"/reference/instructions\"},{\"text\":\"Tools\",\"link\":\"/reference/tools\"},{\"text\":\"prompt\",\"link\":\"/reference/prompt\"},{\"text\":\"Skills\",\"link\":\"/reference/skills\"},{\"text\":\"MCP Connections\",\"link\":\"/reference/connections\"},{\"text\":\"Subagents\",\"link\":\"/reference/subagents\"},{\"text\":\"Channels\",\"link\":\"/reference/channels\"},{\"text\":\"Schedules & reminders\",\"link\":\"/reference/schedules\"},{\"text\":\"Hooks\",\"link\":\"/reference/hooks\"},{\"text\":\"Memory\",\"link\":\"/reference/memory\"},{\"text\":\"Evals\",\"link\":\"/reference/evals\"},{\"text\":\"Artifacts\",\"link\":\"/reference/artifacts\"},{\"text\":\"Sessions & streaming\",\"link\":\"/reference/sessions\"},{\"text\":\"Playground\",\"link\":\"/reference/playground\"},{\"text\":\"CLI\",\"link\":\"/reference/cli\"},{\"text\":\"HTTP API\",\"link\":\"/reference/http-api\"}]}]},\"locales\":{},\"scrollOffset\":134,\"cleanUrls\":false}");</script>
+    <script>window.__VP_HASH_MAP__=JSON.parse("{\"building-with-agents.md\":\"FZXrY8Nk\",\"deployment.md\":\"3MMWuPeV\",\"evals.md\":\"CHR34K1Y\",\"guides_agent-to-agent.md\":\"CwL5cwuE\",\"guides_bitbucket.md\":\"CKUayYtD\",\"guides_cloud-agents.md\":\"BzbzcOyj\",\"guides_convert-automation.md\":\"DMEX9nF-\",\"guides_export-grokbot.md\":\"qo5bxi4h\",\"guides_github.md\":\"TuNiZAOQ\",\"guides_gitlab.md\":\"CtNI4fSH\",\"guides_grokbot-agents.md\":\"BwAykJ7U\",\"guides_hooks.md\":\"Bfj0pK91\",\"guides_improve.md\":\"CZKVt1cT\",\"guides_jev.md\":\"D7XH4JH3\",\"guides_mcp-oauth.md\":\"BM_eFC0L\",\"guides_migrate.md\":\"CQlGaBKX\",\"guides_opentelemetry.md\":\"DBQtp7_V\",\"guides_pagerduty.md\":\"BHXMcMtx\",\"guides_slack.md\":\"Bn-WupSE\",\"guides_webhooks.md\":\"Cpdc3BDX\",\"hillclimbing.md\":\"Dxvd-0gT\",\"index.md\":\"CAnsLl8D\",\"quickstart.md\":\"D8JDfkKO\",\"reference_agent-config.md\":\"IplwL25I\",\"reference_artifacts.md\":\"DLV9MZES\",\"reference_channels.md\":\"Bxaa020x\",\"reference_cli.md\":\"1o_TqKdt\",\"reference_connections.md\":\"BJE2Zllp\",\"reference_evals.md\":\"Ccwp4x3o\",\"reference_extensions.md\":\"DKxTuCIw\",\"reference_hooks.md\":\"B1jq3oGl\",\"reference_http-api.md\":\"Dji-DD_Z\",\"reference_instructions.md\":\"BYMVxAkw\",\"reference_memory.md\":\"BwyJXYZe\",\"reference_playground.md\":\"q4MI-0td\",\"reference_project-layout.md\":\"mFcS8yDD\",\"reference_prompt.md\":\"DqPh71XN\",\"reference_schedules.md\":\"03Ryy9ca\",\"reference_sessions.md\":\"C8FXuGwk\",\"reference_skills.md\":\"C2GWh7g8\",\"reference_subagents.md\":\"ChNGh6HK\",\"reference_tools.md\":\"-6pypsWt\",\"templates_agentic-owners.md\":\"CTEnR0jp\",\"templates_grokbot-agents.md\":\"DgpPEs7B\",\"templates_security-reviewer.md\":\"Gh6EF9Us\",\"templates_thermo-quality-review.md\":\"B77UyTrX\",\"templates_thermo-review.md\":\"DRJ7mC5U\",\"templates_triage.md\":\"CNN6b0JZ\",\"troubleshooting.md\":\"DFnoTDlQ\"}");window.__VP_SITE_DATA__=JSON.parse("{\"lang\":\"en-US\",\"dir\":\"ltr\",\"title\":\"Bot Development Kit (BDK)\",\"description\":\"Build and serve bots and agents from versioned Markdown and TypeScript.\",\"base\":\"/docs/\",\"head\":[],\"router\":{\"prefetchLinks\":true},\"appearance\":true,\"themeConfig\":{\"sdkVersion\":\"0.2.25\",\"nav\":[{\"text\":\"Quickstart\",\"link\":\"/quickstart\"},{\"text\":\"Guides\",\"link\":\"/guides/mcp-oauth\"},{\"text\":\"Integrations\",\"link\":\"/guides/github\"},{\"text\":\"Templates\",\"link\":\"/templates/security-reviewer\"},{\"text\":\"Reference\",\"link\":\"/reference/project-layout\"}],\"search\":{\"provider\":\"local\"},\"outline\":{\"level\":[2,3]},\"sidebar\":[{\"text\":\"Getting started\",\"items\":[{\"text\":\"Overview\",\"link\":\"/\"},{\"text\":\"Building your first agent\",\"link\":\"/quickstart\"}]},{\"text\":\"Integrations\",\"collapsed\":false,\"items\":[{\"text\":\"GitHub\",\"link\":\"/guides/github\"},{\"text\":\"Slack\",\"link\":\"/guides/slack\"},{\"text\":\"Webhooks\",\"link\":\"/guides/webhooks\"},{\"text\":\"Cursor Automations\",\"link\":\"/guides/convert-automation\"},{\"text\":\"OpenTelemetry\",\"link\":\"/guides/opentelemetry\"},{\"text\":\"GitLab\",\"link\":\"/guides/gitlab\"},{\"text\":\"Bitbucket\",\"link\":\"/guides/bitbucket\"},{\"text\":\"PagerDuty\",\"link\":\"/guides/pagerduty\"}]},{\"text\":\"Extensions\",\"collapsed\":false,\"items\":[{\"text\":\"Overview\",\"link\":\"/reference/extensions\"},{\"text\":\"Cloud agents\",\"link\":\"/guides/cloud-agents\"},{\"text\":\"Grok Bot agents\",\"link\":\"/guides/grokbot-agents\"},{\"text\":\"Self-improvement\",\"link\":\"/guides/improve\"},{\"text\":\"Jev\",\"link\":\"/guides/jev\"}]},{\"text\":\"Guides\",\"collapsed\":false,\"items\":[{\"text\":\"MCP\",\"link\":\"/guides/mcp-oauth\"},{\"text\":\"Hooks\",\"link\":\"/guides/hooks\"},{\"text\":\"Peer agents\",\"link\":\"/guides/agent-to-agent\"},{\"text\":\"Deployment\",\"link\":\"/deployment\"},{\"text\":\"Export a Grok Bot\",\"link\":\"/guides/export-grokbot\"},{\"text\":\"Early-alpha migration\",\"link\":\"/guides/migrate\"},{\"text\":\"Evals\",\"link\":\"/evals\"},{\"text\":\"Hillclimbing\",\"link\":\"/hillclimbing\"},{\"text\":\"Build with a coding agent\",\"link\":\"/building-with-agents\"},{\"text\":\"Troubleshooting\",\"link\":\"/troubleshooting\"}]},{\"text\":\"Templates\",\"collapsed\":false,\"items\":[{\"text\":\"Grok Bot agents\",\"link\":\"/templates/grokbot-agents\"},{\"text\":\"Security reviewer\",\"link\":\"/templates/security-reviewer\"},{\"text\":\"Thermo review\",\"link\":\"/templates/thermo-review\"},{\"text\":\"Thermo quality review\",\"link\":\"/templates/thermo-quality-review\"},{\"text\":\"Agentic Approver\",\"link\":\"/templates/agentic-owners\"},{\"text\":\"Triage agent\",\"link\":\"/templates/triage\"}]},{\"text\":\"Reference\",\"collapsed\":false,\"items\":[{\"text\":\"Project layout\",\"link\":\"/reference/project-layout\"},{\"text\":\"Agent config\",\"link\":\"/reference/agent-config\"},{\"text\":\"Instructions\",\"link\":\"/reference/instructions\"},{\"text\":\"Tools\",\"link\":\"/reference/tools\"},{\"text\":\"prompt\",\"link\":\"/reference/prompt\"},{\"text\":\"Skills\",\"link\":\"/reference/skills\"},{\"text\":\"MCP Connections\",\"link\":\"/reference/connections\"},{\"text\":\"Subagents\",\"link\":\"/reference/subagents\"},{\"text\":\"Channels\",\"link\":\"/reference/channels\"},{\"text\":\"Schedules & reminders\",\"link\":\"/reference/schedules\"},{\"text\":\"Hooks\",\"link\":\"/reference/hooks\"},{\"text\":\"Memory\",\"link\":\"/reference/memory\"},{\"text\":\"Evals\",\"link\":\"/reference/evals\"},{\"text\":\"Artifacts\",\"link\":\"/reference/artifacts\"},{\"text\":\"Sessions & streaming\",\"link\":\"/reference/sessions\"},{\"text\":\"Playground\",\"link\":\"/reference/playground\"},{\"text\":\"CLI\",\"link\":\"/reference/cli\"},{\"text\":\"HTTP API\",\"link\":\"/reference/http-api\"}]}]},\"locales\":{},\"scrollOffset\":134,\"cleanUrls\":false}");</script>
     
   </body>
 </html>