@cursor/bdk 0.2.24 → 0.2.25

package/dist/internal/discovery/project.js

@@ -8,7 +8,7 @@ import { applyAgentContinuationDefaults, warnOmittedContinuationDowngrades, } fr
 import { httpChannel } from "../http-channel-define.js";
 import { loadAgent, warnUnknownSlots } from "./agent.js";
 import { loadChannels } from "./channels.js";
-import { defaultImportModule, displayPath, } from "./context.js";
+import { defaultImportModule, displayPath, pushConfigDiagnostic, } from "./context.js";
 import { hasFlatLayoutMarkers, isDirectory, readPackageName, sortedEntries } from "./fs.js";
 import { loadHooks } from "./hooks.js";
 import { NAME_PATTERN, RESERVED_SLUGS } from "./names.js";
@@ -166,7 +166,7 @@ export async function loadAgentProject(dir, options = {}) {
     const { channels, httpChannelDefinition } = await loadChannels(ctx, join(agentDir, "channels"));
     for (const channel of projectSlots.channels) {
         if (channel.id === "http" || channels.some((c) => c.id === channel.id)) {
-            ctx.diagnostics.push({
+            pushConfigDiagnostic(ctx, {
                 severity: "error",
                 path: displayPath(ctx, join(agentDir, "extensions")),
                 message: `Extension channel "${channel.id}" collides with an agent channel.`,
@@ -194,18 +194,26 @@ export async function loadAgentProject(dir, options = {}) {
         const channelPath = displayPath(ctx, join(agentDir, "channels", `${channel.id}.ts`));
         const architectureError = channelArchitectureError(agent.architecture, channel.definition);
         if (architectureError !== undefined) {
-            ctx.diagnostics.push({ severity: "error", path: channelPath, message: architectureError });
+            pushConfigDiagnostic(ctx, {
+                severity: "error",
+                path: channelPath,
+                message: architectureError,
+            });
         }
         const migrationWarning = channelArchitectureMigrationWarning(agent.architecture, channel.definition);
         if (migrationWarning !== undefined) {
-            ctx.diagnostics.push({ severity: "warning", path: channelPath, message: migrationWarning });
+            pushConfigDiagnostic(ctx, {
+                severity: "warning",
+                path: channelPath,
+                message: migrationWarning,
+            });
         }
     }
     warnOmittedContinuationDowngrades({
         architecture: agent.architecture,
         channels,
         warn: (id, message) => {
-            ctx.diagnostics.push({
+            pushConfigDiagnostic(ctx, {
                 severity: "warning",
                 path: displayPath(ctx, join(agentDir, "channels", `${id}.ts`)),
                 message,
@@ -264,3 +272,17 @@ export function formatDiagnostics(diagnostics) {
     })
         .join("\n");
 }
+export function formatValidateJson(mounts) {
+    const agents = mounts.map(({ slug, project }) => ({
+        slug,
+        diagnostics: project.diagnostics.map((diagnostic) => ({
+            severity: diagnostic.severity,
+            code: diagnostic.code ?? "other",
+            path: diagnostic.path,
+            package: diagnostic.package,
+            message: diagnostic.message,
+        })),
+    }));
+    const ok = !agents.some((agent) => agent.diagnostics.some((diagnostic) => diagnostic.severity === "error"));
+    return `${JSON.stringify({ version: 1, ok, agents })}\n`;
+}

package/dist/internal/discovery/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,GAAG,SAAS,GAChC,YAAY,CAed;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC1B,GACA,IAAI,CA2DN;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IACN,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;CAC1B,GACA,IAAI,CAkCN"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,gBAAgB,EAAqC,MAAM,cAAc,CAAC;AAExF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,GAAG,SAAS,GAChC,YAAY,CAed;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC1B,GACA,IAAI,CA2DN;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IACN,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;CAC1B,GACA,IAAI,CAkCN"}

package/dist/internal/discovery/runtime.js

@@ -2,7 +2,7 @@
  * Runtime resolution and the limitations each runtime imposes on the authored surface.
  */
 import { join } from "node:path";
-import { displayPath } from "./context.js";
+import { displayPath, pushConfigDiagnostic } from "./context.js";
 /**
  * Validate the authored runtime. An unrecognized value is an error
  * diagnostic and falls back to local — a typo must not silently pick a
@@ -15,7 +15,7 @@ export function resolveRuntime(ctx, agentDir, runtime) {
         runtime === "grokbot") {
         return runtime ?? "local";
     }
-    ctx.diagnostics.push({
+    pushConfigDiagnostic(ctx, {
         severity: "error",
         path: displayPath(ctx, join(agentDir, "agent.ts")),
         message: `runtime must be "local", "cloud", or "grokbot"; got ${JSON.stringify(runtime)}.`,
@@ -31,10 +31,10 @@ export function resolveRuntime(ctx, agentDir, runtime) {
 export function checkGrokBotRuntimeLimitations(ctx, agentDir, counts) {
     const agentPath = displayPath(ctx, join(agentDir, "agent.ts"));
     const error = (path, message) => {
-        ctx.diagnostics.push({ severity: "error", path, message });
+        pushConfigDiagnostic(ctx, { severity: "error", path, message });
     };
     const warn = (path, message) => {
-        ctx.diagnostics.push({ severity: "warning", path, message });
+        pushConfigDiagnostic(ctx, { severity: "warning", path, message });
     };
     if (counts.serverTools > 0) {
         error(displayPath(ctx, join(agentDir, "tools")), 'Server tools (execution: "server", including opted-in builtinTools) are not reachable from grokbot turns yet. Remove them or run the agent on the local runtime.');
@@ -67,28 +67,28 @@ export function checkGrokBotRuntimeLimitations(ctx, agentDir, counts) {
 export function warnCloudRuntimeLimitations(ctx, agentDir, counts) {
     const agentPath = displayPath(ctx, join(agentDir, "agent.ts"));
     if (!counts.hasCloudOptions) {
-        ctx.diagnostics.push({
+        pushConfigDiagnostic(ctx, {
             severity: "warning",
             path: agentPath,
             message: 'runtime: "cloud" usually needs a `cloud` block (e.g. repos / env). Without it the Cursor cloud API may reject create.',
         });
     }
     if (counts.agentTools > 0) {
-        ctx.diagnostics.push({
+        pushConfigDiagnostic(ctx, {
             severity: "warning",
             path: displayPath(ctx, join(agentDir, "tools")),
             message: 'Agent tools (execution: "agent") are described on the first cloud prompt (with script bodies); they are not written into the cloud VM filesystem automatically.',
         });
     }
     if (counts.skills > 0) {
-        ctx.diagnostics.push({
+        pushConfigDiagnostic(ctx, {
             severity: "warning",
             path: displayPath(ctx, join(agentDir, "skills")),
             message: "Authored skills reach cloud agents through native store discovery: hosted deployments write the deployment store's skills/ directory; local serve/run with a personal API key writes agent-serve/<agent>/skills/ on the USER store. Without a reachable store, only skills already in the cloud repo are visible.",
         });
     }
     if (counts.seedFiles > 0) {
-        ctx.diagnostics.push({
+        pushConfigDiagnostic(ctx, {
             severity: "warning",
             path: displayPath(ctx, join(agentDir, "sandbox")),
             message: "sandbox/workspace seed files reach cloud agents through the Agent Store, not the checkout: hosted deployments write the deployment store's workspace/ directory; local serve/run with a personal API key writes agent-serve/<agent>/workspace/ on the USER store. The first cloud prompt names the mounted directory. Without a reachable store, cloud turns do not see them.",

package/dist/internal/discovery.d.ts

@@ -11,5 +11,5 @@
 export { DEFAULT_AGENT_ARCHITECTURE, runtimeArchitectureCompatibilityError, } from "./discovery/agent-config.js";
 export type { LoadAgentProjectOptions } from "./discovery/context.js";
 export { projectInfo } from "./discovery/info.js";
-export { type ChildAgentDir, formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, loadAgentProjects, resolveAgentMounts, } from "./discovery/project.js";
+export { type ChildAgentDir, formatDiagnostics, formatValidateJson, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, loadAgentProjects, resolveAgentMounts, } from "./discovery/project.js";
 //# sourceMappingURL=discovery.d.ts.map

package/dist/internal/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/internal/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,GACtC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,aAAa,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/internal/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,GACtC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,aAAa,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC"}

package/dist/internal/discovery.js

@@ -10,4 +10,4 @@
  */
 export { DEFAULT_AGENT_ARCHITECTURE, runtimeArchitectureCompatibilityError, } from "./discovery/agent-config.js";
 export { projectInfo } from "./discovery/info.js";
-export { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, loadAgentProjects, resolveAgentMounts, } from "./discovery/project.js";
+export { formatDiagnostics, formatValidateJson, hasErrorDiagnostics, isAgentProjectDir, listChildAgentDirs, loadAgentProject, loadAgentProjects, resolveAgentMounts, } from "./discovery/project.js";

package/dist/internal/expected-delivery-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"expected-delivery-failure.d.ts","sourceRoot":"","sources":["../../src/internal/expected-delivery-failure.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,6BAA6B,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE7E,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,6BAA6B,GAAG,SAAS,CAY3C"}
+{"version":3,"file":"expected-delivery-failure.d.ts","sourceRoot":"","sources":["../../src/internal/expected-delivery-failure.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,6BAA6B,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE7E,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,6BAA6B,GAAG,SAAS,CAY3C"}

package/dist/internal/expected-delivery-failure.js

@@ -11,6 +11,12 @@ const USAGE_LIMIT_PHRASES = [
     // Billing titles insert "monthly", or say "hit" instead of "reached".
     "monthly usage limit",
     "hit your usage limit",
+    // Prepaid wallets: the additional-usage cap or an exhausted balance.
+    "monthly additional usage limit",
+    "additional usage is off",
+    "prepaid balance is used up",
+    // A team's spend reached the budget its organization set.
+    "team budget limit reached",
 ];
 const UNPAID_INVOICE_PHRASES = ["unpaid invoice"];
 export function classifyExpectedDeliveryFailure(message) {

package/dist/internal/filesystem/sdk-schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk-schemas.d.ts","sourceRoot":"","sources":["../../../src/internal/filesystem/sdk-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAmB3B,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAE1B,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAM7B,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAI3B,CAAC;AAEH,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,UAO9B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAE5B,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,UAI/B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAG1B,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAO7B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAe1B,CAAC;AAuCH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAK7B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,CAAC,CAAC,UAGxB,CAAC;AA0BH,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAI3B,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAKhC,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAM7B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAI/B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAIlC,CAAC"}
+{"version":3,"file":"sdk-schemas.d.ts","sourceRoot":"","sources":["../../../src/internal/filesystem/sdk-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAmB3B,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAE1B,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAM7B,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,UAI3B,CAAC;AAEH,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,UAO9B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAE5B,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,UAI/B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAG1B,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAO7B,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAe1B,CAAC;AAuCH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAK7B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,CAAC,CAAC,UAGxB,CAAC;AAgBH,eAAO,MAAM,WAAW,EAAE,CAAC,CAAC,UAI3B,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,EAAE,CAAC,CAAC,UAKhC,CAAC;AAEH,eAAO,MAAM,aAAa,EAAE,CAAC,CAAC,UAM7B,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,UAI/B,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,UAIlC,CAAC"}

package/dist/internal/filesystem/sdk-schemas.js

@@ -120,14 +120,15 @@ export const sdkLsArgs = z.object({
 const lsDirectoryTreeNodeFile = z.object({
     name: z.string(),
 });
-const lsDirectoryTreeNode = z.lazy(() => z.object({
+// Not z.lazy: zod-to-json-schema warns on recursion with $refStrategy "none".
+const lsDirectoryTreeNode = z.object({
     absPath: z.string(),
-    childrenDirs: z.array(lsDirectoryTreeNode),
+    childrenDirs: z.array(z.unknown()),
     childrenFiles: z.array(lsDirectoryTreeNodeFile),
     childrenWereProcessed: z.boolean(),
     fullSubtreeExtensionCounts: z.record(z.number()),
     numFiles: z.number(),
-}));
+});
 export const sdkLsResult = resultSchema(z.object({
     directoryTreeRoot: lsDirectoryTreeNode,
 }));

package/dist/internal/hmac-secret-values.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Multi-value HMAC secrets, July copy. The control plane keeps an
+ * equivalent parser and matcher in
+ * `backend/packages/server-shared/src/agentServe/agentSdkCatch.ts`; a
+ * backend drift test runs both over the shared vectors in
+ * `testing/hmac-secret-vectors.ts`.
+ *
+ * One named secret may hold several signing secrets, one per line, so a
+ * route that several provider subscriptions sign (each with its own
+ * secret), or one whose secret is mid-rotation, verifies under any of
+ * them. A value with no line break is one secret, used byte-for-byte.
+ */
+/**
+ * Most signing secrets one named secret may hold. The control plane runs
+ * one HMAC per value over every unauthenticated request before any
+ * per-deployment limit applies, so the count is bounded rather than left to
+ * the secret's byte limit. A value over the cap verifies nothing.
+ */
+export declare const MAX_HMAC_SECRET_VALUES = 32;
+/** At least one signing secret. */
+export type HmacSecrets = readonly [string, ...string[]];
+export type ParsedHmacSecrets = {
+    ok: true;
+    secrets: HmacSecrets;
+} | {
+    ok: false;
+    reason: "unset" | "too_many_values";
+};
+/**
+ * The signing secrets a named secret's value holds. Lines are trimmed and
+ * blank lines dropped; an unset or blank value is `unset`.
+ */
+export declare function parseHmacSecrets(raw: string | undefined): ParsedHmacSecrets;
+/**
+ * True when any signature in `presented` is `prefix` + the hex HMAC-SHA256
+ * of `body` under any of `secrets`. Without a `separator` the whole value is
+ * one signature. Every (secret, signature) pair is compared in constant
+ * time with no early exit, so timing does not reveal which matched; entries
+ * without the prefix never match.
+ */
+export declare function hmacSignatureMatchesAny(args: {
+    body: string | Buffer;
+    presented: string;
+    secrets: HmacSecrets;
+    prefix: string;
+    separator: string | undefined;
+}): boolean;
+//# sourceMappingURL=hmac-secret-values.d.ts.map

package/dist/internal/hmac-secret-values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac-secret-values.d.ts","sourceRoot":"","sources":["../../src/internal/hmac-secret-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,mCAAmC;AACnC,MAAM,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAIvD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAe3E;AAQD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,GAAG,OAAO,CAmBV"}

package/dist/internal/hmac-secret-values.js

@@ -0,0 +1,68 @@
+/**
+ * Multi-value HMAC secrets, July copy. The control plane keeps an
+ * equivalent parser and matcher in
+ * `backend/packages/server-shared/src/agentServe/agentSdkCatch.ts`; a
+ * backend drift test runs both over the shared vectors in
+ * `testing/hmac-secret-vectors.ts`.
+ *
+ * One named secret may hold several signing secrets, one per line, so a
+ * route that several provider subscriptions sign (each with its own
+ * secret), or one whose secret is mid-rotation, verifies under any of
+ * them. A value with no line break is one secret, used byte-for-byte.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Most signing secrets one named secret may hold. The control plane runs
+ * one HMAC per value over every unauthenticated request before any
+ * per-deployment limit applies, so the count is bounded rather than left to
+ * the secret's byte limit. A value over the cap verifies nothing.
+ */
+export const MAX_HMAC_SECRET_VALUES = 32;
+const LINE_BREAK = /\r\n|\n|\r/;
+/**
+ * The signing secrets a named secret's value holds. Lines are trimmed and
+ * blank lines dropped; an unset or blank value is `unset`.
+ */
+export function parseHmacSecrets(raw) {
+    const [first, ...rest] = raw === undefined || !LINE_BREAK.test(raw)
+        ? [raw ?? ""].filter((value) => value !== "")
+        : raw
+            .split(LINE_BREAK)
+            .map((line) => line.trim())
+            .filter((line) => line !== "");
+    if (first === undefined) {
+        return { ok: false, reason: "unset" };
+    }
+    if (rest.length + 1 > MAX_HMAC_SECRET_VALUES) {
+        return { ok: false, reason: "too_many_values" };
+    }
+    return { ok: true, secrets: [first, ...rest] };
+}
+function constantTimeStringEquals(a, b) {
+    const aBytes = Buffer.from(a, "utf8");
+    const bBytes = Buffer.from(b, "utf8");
+    return aBytes.length === bBytes.length && timingSafeEqual(aBytes, bBytes);
+}
+/**
+ * True when any signature in `presented` is `prefix` + the hex HMAC-SHA256
+ * of `body` under any of `secrets`. Without a `separator` the whole value is
+ * one signature. Every (secret, signature) pair is compared in constant
+ * time with no early exit, so timing does not reveal which matched; entries
+ * without the prefix never match.
+ */
+export function hmacSignatureMatchesAny(args) {
+    const entries = (args.separator === undefined || args.separator.length === 0
+        ? [args.presented]
+        : args.presented.split(args.separator)).map((raw) => raw.trim());
+    let matched = false;
+    for (const secret of args.secrets) {
+        const expected = createHmac("sha256", secret).update(args.body).digest("hex");
+        for (const entry of entries) {
+            if (entry.startsWith(args.prefix) &&
+                constantTimeStringEquals(entry.slice(args.prefix.length).toLowerCase(), expected)) {
+                matched = true;
+            }
+        }
+    }
+    return matched;
+}

package/dist/internal/host-platforms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-platforms.d.ts","sourceRoot":"","sources":["../../src/internal/host-platforms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,gBAAgB,GAAG,KAAK,GAAG,IAAI,GAAG,aAAa,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnE,eAAe,CAmBjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAiBrF;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAYjF;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgDhC"}
+{"version":3,"file":"host-platforms.d.ts","sourceRoot":"","sources":["../../src/internal/host-platforms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAErE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,eAAe,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,gBAAgB,GAAG,KAAK,GAAG,IAAI,GAAG,aAAa,CAAC;AAE3F,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,kFAAkF;AAClF,wBAAgB,qBAAqB,CACnC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnE,eAAe,CAsBjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAoBrF;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAYjF;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgDhC"}

package/dist/internal/host-platforms.js

@@ -21,7 +21,10 @@ export function createHostSlackClient(options = {}) {
                     throw new Error(`No Slack bot token available (set ${hint}).`);
                 }
                 return new WebClient(token);
-            })();
+            })().catch((error) => {
+                slackPromise = undefined;
+                throw error;
+            });
             return slackPromise;
         },
     };
@@ -38,6 +41,9 @@ export function createHostPlatforms(options = {}) {
             getOctokit: () => {
                 octokitPromise ??= createGitHubOctokit({
                     credentials: options.githubCredentials,
+                }).catch((error) => {
+                    octokitPromise = undefined;
+                    throw error;
                 });
                 return octokitPromise;
             },
@@ -89,7 +95,7 @@ export async function warmupHostGitHubAuth(options) {
         }
     }
     const label = source === "cursor-account"
-        ? "Cursor account repo-scoped credential (also exported as GH_TOKEN for gh CLI)"
+        ? "Cursor account credential"
         : source === "app"
             ? exportedGhToken
                 ? "GitHub App installation token (also exported as GH_TOKEN for gh CLI)"

package/dist/internal/json-schema.d.ts

@@ -1,15 +1,15 @@
-import { z } from "zod/v3";
-import type { JsonSchemaObject } from "../types.js";
-export declare function isZodSchema(value: unknown): value is z.ZodTypeAny;
+import type { JsonSchemaObject, ZodSchema } from "../types.js";
+export declare function isZodSchema(value: unknown): value is ZodSchema;
 /** Convert an authored input schema into the JSON Schema shown to the model. */
-export declare function toolInputJsonSchema(inputSchema: z.ZodTypeAny | JsonSchemaObject | undefined): JsonSchemaObject;
+export declare function toolInputJsonSchema(inputSchema: ZodSchema | JsonSchemaObject | undefined): JsonSchemaObject;
 /**
  * Convert an authored output schema into the JSON Schema advertised on the
  * tool. Unlike {@link toolInputJsonSchema} there is no fallback: an
  * undeclared output schema stays undeclared (the MCP field is optional), and
- * outputs are never validated against it.
+ * outputs are never validated against it. Zod 4 schemas describe the
+ * `execute` result here, so fields with a default are required.
  */
-export declare function toolOutputJsonSchema(outputSchema: z.ZodTypeAny | JsonSchemaObject | undefined): JsonSchemaObject | undefined;
+export declare function toolOutputJsonSchema(outputSchema: ZodSchema | JsonSchemaObject | undefined): JsonSchemaObject | undefined;
 export type ToolInputValidation = {
     ok: true;
     value: unknown;
@@ -21,5 +21,5 @@ export type ToolInputValidation = {
  * Validate tool-call args before `execute` runs. Zod schemas validate (and
  * transform); plain JSON schemas pass through unvalidated.
  */
-export declare function validateToolInput(inputSchema: z.ZodTypeAny | JsonSchemaObject | undefined, args: unknown): ToolInputValidation;
+export declare function validateToolInput(inputSchema: ZodSchema | JsonSchemaObject | undefined, args: unknown): ToolInputValidation;
 //# sourceMappingURL=json-schema.d.ts.map

package/dist/internal/json-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-schema.d.ts","sourceRoot":"","sources":["../../src/internal/json-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQpD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,UAAU,CAajE;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,gBAAgB,GAAG,SAAS,GACvD,gBAAgB,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,CAAC,CAAC,UAAU,GAAG,gBAAgB,GAAG,SAAS,GACxD,gBAAgB,GAAG,SAAS,CAK9B;AAsBD,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,CAAC,CAAC,UAAU,GAAG,gBAAgB,GAAG,SAAS,EACxD,IAAI,EAAE,OAAO,GACZ,mBAAmB,CAerB"}
+{"version":3,"file":"json-schema.d.ts","sourceRoot":"","sources":["../../src/internal/json-schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAS/D,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAa9D;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS,GACpD,gBAAgB,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS,GACrD,gBAAgB,GAAG,SAAS,CAK9B;AAmBD,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,SAAS,GAAG,gBAAgB,GAAG,SAAS,EACrD,IAAI,EAAE,OAAO,GACZ,mBAAmB,CAerB"}

package/dist/internal/json-schema.js

@@ -1,5 +1,6 @@
 import { z } from "zod/v3";
 import { zodToJsonSchema } from "zod-to-json-schema";
+import { isZodV4Schema, zodV4ToJsonSchema } from "./zod-schema.js";
 const ANY_OBJECT_SCHEMA = {
     type: "object",
     properties: {},
@@ -22,38 +23,34 @@ export function toolInputJsonSchema(inputSchema) {
     if (inputSchema === undefined) {
         return ANY_OBJECT_SCHEMA;
     }
-    return authoredSchemaToJsonSchema(inputSchema);
+    return authoredSchemaToJsonSchema(inputSchema, "input");
 }
 /**
  * Convert an authored output schema into the JSON Schema advertised on the
  * tool. Unlike {@link toolInputJsonSchema} there is no fallback: an
  * undeclared output schema stays undeclared (the MCP field is optional), and
- * outputs are never validated against it.
+ * outputs are never validated against it. Zod 4 schemas describe the
+ * `execute` result here, so fields with a default are required.
  */
 export function toolOutputJsonSchema(outputSchema) {
     if (outputSchema === undefined) {
         return undefined;
     }
-    return authoredSchemaToJsonSchema(outputSchema);
+    return authoredSchemaToJsonSchema(outputSchema, "output");
 }
-function authoredSchemaToJsonSchema(schema) {
+function authoredSchemaToJsonSchema(schema, io) {
     if (!isZodSchema(schema)) {
         return schema;
     }
-    const converted = convertZodSchema(schema);
+    const converted = isZodV4Schema(schema)
+        ? zodV4ToJsonSchema(schema, io)
+        : zodToJsonSchema(schema, {
+            $refStrategy: "none",
+            target: "jsonSchema7",
+        });
     delete converted.$schema;
     return converted;
 }
-function convertZodSchema(schema) {
-    const native = schema.toJSONSchema;
-    if (typeof native === "function") {
-        return native.call(schema);
-    }
-    return zodToJsonSchema(schema, {
-        $refStrategy: "none",
-        target: "jsonSchema7",
-    });
-}
 /**
  * Validate tool-call args before `execute` runs. Zod schemas validate (and
  * transform); plain JSON schemas pass through unvalidated.
@@ -68,7 +65,7 @@ export function validateToolInput(inputSchema, args) {
     }
     const issues = parsed.error.issues
         .map((issue) => {
-        const path = issue.path.join(".");
+        const path = issue.path.map(String).join(".");
         return path === "" ? issue.message : `${path}: ${issue.message}`;
     })
         .join("; ");

package/dist/internal/otel/collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/collector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMhD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E;;;;OAIG;IACH,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,0FAA0F;IAC1F,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC;IAC7D,yEAAyE;IACzE,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;IACrF,mEAAmE;IACnE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CAChF;AAkBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,aAAa,CAs1Bf"}
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/collector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAMhD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E;;;;OAIG;IACH,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1E,0FAA0F;IAC1F,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC;IAC7D,yEAAyE;IACzE,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;IACrF,mEAAmE;IACnE,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CAChF;AAkBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,aAAa,CAw1Bf"}

package/dist/internal/otel/collector.js

@@ -247,6 +247,7 @@ export function createOtelCollector(runtime, agentName, log) {
                 const turn = ensureTurn(event, session, startTime);
                 const span = turn?.tools.get(event.data.callId);
                 const status = event.data.isError ? "failure" : "success";
+                const failureReason = event.data.isError ? toolFailureReason(event.data.output) : undefined;
                 if (span !== undefined) {
                     span.setAttribute("cursor.tool.status", status);
                     span.setAttributes(attrs(computerUseResultAttrs(event.data)));
@@ -259,7 +260,7 @@ export function createOtelCollector(runtime, agentName, log) {
                         span.setAttribute("agent_sdk.tool_error_class", errorClass);
                         span.setStatus({
                             code: SpanStatusCode.ERROR,
-                            message: toolFailureReason(event.data.output) ?? "tool error",
+                            message: failureReason ?? "tool error",
                         });
                     }
                     span.end(startTime);
@@ -277,6 +278,7 @@ export function createOtelCollector(runtime, agentName, log) {
                     "cursor.tool.name": event.data.toolName,
                     "cursor.tool.status": status,
                     "agent_sdk.call_id": event.data.callId,
+                    "agent_sdk.error_message": failureReason,
                 }));
                 // Direct callTool never emits turn.completed — close when idle.
                 if (turn !== undefined &&

package/dist/internal/otel/config.d.ts

@@ -2,6 +2,11 @@
  * Merge authored `defineOtel`, `serve({ otel })`, and standard OTel env.
  */
 import { type OtelConfig, type OtelDefinition, type OtelExporterConfig, type OtelLogOptions, type OtelMetricOptions, type OtelSignal, type OtelTraceOptions } from "../../otel.js";
+export type MetricsTemporality = "cumulative" | "delta" | "lowmemory";
+export interface ResolvedOtelMetrics extends OtelMetricOptions {
+    temporality: MetricsTemporality;
+    unrecognizedTemporality?: string;
+}
 export interface ResolvedOtelConfig {
     enabled: boolean;
     serviceName: string;
@@ -9,7 +14,7 @@ export interface ResolvedOtelConfig {
     resourceAttributes: Record<string, string>;
     exporters: OtelExporterConfig[];
     traces: false | OtelTraceOptions;
-    metrics: false | OtelMetricOptions;
+    metrics: false | ResolvedOtelMetrics;
     logs: false | OtelLogOptions;
 }
 /**

package/dist/internal/otel/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAEtB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,MAAM,EAAE,KAAK,GAAG,gBAAgB,CAAC;IACjC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC;IACnC,IAAI,EAAE,KAAK,GAAG,cAAc,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC,GAC3E,cAAc,GAAG,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,KAAK,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,kBAAkB,CAkDrB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBhF;AAWD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,MAAM,EAAE,UAAU,GACjB,kBAAkB,EAAE,CAItB;AAED,wBAAgB,kBAAkB,IAAI,kBAAkB,CAWvD;AA8GD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYjD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAEtB,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,OAAO,GAAG,WAAW,CAAC;AAEtE,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,WAAW,EAAE,kBAAkB,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,MAAM,EAAE,KAAK,GAAG,gBAAgB,CAAC;IACjC,OAAO,EAAE,KAAK,GAAG,mBAAmB,CAAC;IACrC,IAAI,EAAE,KAAK,GAAG,cAAc,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC,GAC3E,cAAc,GAAG,SAAS,CAmB5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,KAAK,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,kBAAkB,CAkDrB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBhF;AAWD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,MAAM,EAAE,UAAU,GACjB,kBAAkB,EAAE,CAItB;AAED,wBAAgB,kBAAkB,IAAI,kBAAkB,CAWvD;AAgJD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYjD"}

package/dist/internal/otel/config.js

@@ -56,7 +56,7 @@ export function resolveOtelConfig(input) {
         return disabledOtelConfig();
     }
     const traces = resolveSignal(merged.traces);
-    const metrics = exporters.length === 0 ? false : resolveSignal(merged.metrics);
+    const metrics = exporters.length === 0 ? false : resolveMetrics(merged.metrics, env);
     const logs = exporters.length === 0 ? false : resolveLogs(merged.logs, env);
     if (exporters.length === 0 && traces === false) {
         return disabledOtelConfig();
@@ -170,6 +170,32 @@ function protocolFromEnv(raw) {
     // Default protobuf — matches Cursor enterprise OTLP/HTTP. grpc unsupported.
     return "http/protobuf";
 }
+function metricsTemporalityFromEnv(raw) {
+    const value = raw?.trim().toLowerCase();
+    if (value === undefined || value.length === 0) {
+        return { temporality: "delta", unrecognized: undefined };
+    }
+    switch (value) {
+        case "cumulative":
+        case "delta":
+        case "lowmemory":
+            return { temporality: value, unrecognized: undefined };
+        default:
+            return { temporality: "delta", unrecognized: raw };
+    }
+}
+function resolveMetrics(value, env) {
+    const signal = resolveSignal(value);
+    if (signal === false) {
+        return false;
+    }
+    const parsed = metricsTemporalityFromEnv(env.OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE);
+    return {
+        ...signal,
+        temporality: parsed.temporality,
+        unrecognizedTemporality: parsed.unrecognized,
+    };
+}
 function resolveSignal(value) {
     if (value === false) {
         return false;

package/dist/internal/otel/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,MAAM,EAMZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,MAAM,IAAI,UAAU,EAAQ,MAAM,yBAAyB,CAAC;AAiC1E,OAAO,EAGL,KAAK,kBAAkB,EAExB,MAAM,aAAa,CAAC;AAKrB;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC;IACpC,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,kBAAkB,EACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC3B,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CAsEnB;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC3B,SAAS,GAAE,MAAoC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/runtime.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,MAAM,EAMZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,MAAM,IAAI,UAAU,EAAQ,MAAM,yBAAyB,CAAC;AAmC1E,OAAO,EAIL,KAAK,kBAAkB,EAGxB,MAAM,aAAa,CAAC;AAKrB;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,KAAK,EAAE,KAAK,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,YAAY,EAAE,SAAS,GAAG,SAAS,CAAC;IACpC,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,MAAM,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,kBAAkB,EACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC3B,OAAO,GAAE,wBAA6B,GACrC,iBAAiB,CAsEnB;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC3B,SAAS,GAAE,MAAoC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAef"}