@cursor/bdk 0.2.24 → 0.2.26

package/dist/internal/testing/hmac-secret-vectors.js

@@ -0,0 +1,89 @@
+/**
+ * Multi-value HMAC secret cases shared by the July and control-plane
+ * suites, so both sides split a named secret and admit a delivery the same
+ * way.
+ *
+ * Pure data: server-shared loads this module without importing July runtime
+ * code into the control plane.
+ */
+export const HMAC_SECRET_VECTOR_BODY = '{"event":{"id":"evt-1"}}';
+const thirtyTwo = [
+    "secret-0",
+    ...Array.from({ length: 31 }, (_, index) => `secret-${index + 1}`),
+];
+const thirtyThree = [...thirtyTwo, "secret-32"];
+export const HMAC_SECRET_PARSE_VECTORS = [
+    { name: "empty value", raw: "", expected: "unset" },
+    { name: "single value is used byte-for-byte", raw: "  alpha  ", expected: ["  alpha  "] },
+    { name: "two values", raw: "alpha\nbeta", expected: ["alpha", "beta"] },
+    { name: "CRLF and lone CR", raw: "alpha\r\nbeta\rgamma", expected: ["alpha", "beta", "gamma"] },
+    {
+        name: "trims each line and drops blank lines",
+        raw: "\n  alpha \n\n\t\nbeta\t\n",
+        expected: ["alpha", "beta"],
+    },
+    { name: "single value with a trailing newline", raw: "alpha\n", expected: ["alpha"] },
+    { name: "only blank lines", raw: "\n \n\t\n", expected: "unset" },
+    { name: "exactly the cap", raw: thirtyTwo.join("\n"), expected: thirtyTwo },
+    { name: "one over the cap", raw: thirtyThree.join("\n"), expected: "too_many_values" },
+];
+export const HMAC_SECRET_MATCH_VECTORS = [
+    {
+        name: "single secret, single signature",
+        secretValue: "alpha",
+        entries: [{ signWith: "alpha" }],
+        prefix: "sha256=",
+        admits: true,
+    },
+    {
+        name: "second of two secrets verifies",
+        secretValue: "alpha\nbeta",
+        entries: [{ signWith: "beta" }],
+        prefix: "sha256=",
+        admits: true,
+    },
+    {
+        name: "secret absent from the list",
+        secretValue: "alpha\nbeta",
+        entries: [{ signWith: "gamma" }],
+        prefix: "sha256=",
+        admits: false,
+    },
+    {
+        name: "a listed secret's line is matched trimmed",
+        secretValue: "alpha\n   beta   \n",
+        entries: [{ signWith: "beta" }],
+        prefix: "sha256=",
+        admits: true,
+    },
+    {
+        name: "any signature under any secret",
+        secretValue: "alpha\nbeta",
+        entries: [{ signWith: "gamma" }, { literal: "v1=zz" }, { signWith: "beta" }],
+        prefix: "v1=",
+        separator: ",",
+        admits: true,
+    },
+    {
+        name: "no signature under any secret",
+        secretValue: "alpha\nbeta",
+        entries: [{ signWith: "gamma" }, { signWith: "delta" }],
+        prefix: "v1=",
+        separator: ",",
+        admits: false,
+    },
+    {
+        name: "a whole multi-line value is never itself the key",
+        secretValue: "alpha\nbeta",
+        entries: [{ signWith: "alpha\nbeta" }],
+        prefix: "sha256=",
+        admits: false,
+    },
+    {
+        name: "over the cap admits nothing, even a listed secret",
+        secretValue: thirtyThree.join("\n"),
+        entries: [{ signWith: "secret-0" }],
+        prefix: "sha256=",
+        admits: false,
+    },
+];

package/dist/internal/testing/pagerduty-continuation-fixtures.d.ts

@@ -0,0 +1,42 @@
+/**
+ * PagerDuty v3 webhook continuation fixtures shared by the two continuation
+ * vocabulary copies: `internal/continuation-identity.ts` (BDK) and the
+ * control plane's `agentSdkConversationIdentity.ts` (server-shared). Both
+ * suites import this module, so a payload shape or key format that only one
+ * copy understands fails CI on the other side.
+ *
+ * Pure data and payload builders: no imports, so the server-shared suite
+ * can load it by relative path without pulling `@cursor/bdk` into the
+ * control plane.
+ */
+export interface PagerDutyContinuationFixture {
+    name: string;
+    eventType: string;
+    payload: Record<string, unknown>;
+    /** `cont:` key, or `undefined` when the delivery stamps `evt:`. */
+    expectedKey: string | undefined;
+}
+/** The deployment's own PagerDuty user in these fixtures. */
+export declare const PAGERDUTY_FIXTURE_SELF_USER_ID = "PBOT001";
+export declare const PAGERDUTY_FIXTURE_HUMAN_USER_ID = "PHUM001";
+export declare function pagerDutyUserReference(id: string): Record<string, unknown>;
+export declare function pagerDutyIncidentData(input: {
+    id: string;
+    incidentKey: string | null;
+    status?: string;
+    number?: number;
+}): Record<string, unknown>;
+export declare function pagerDutyIncidentReference(input: {
+    id: string;
+    incidentKey?: string;
+}): Record<string, unknown>;
+/** One signed v3 delivery body: `{ event: { … } }`. */
+export declare function pagerDutyWebhookBody(input: {
+    eventType: string;
+    data: Record<string, unknown> | null;
+    resourceType?: string;
+    agentId?: string | null;
+    eventId?: string;
+}): Record<string, unknown>;
+export declare const PAGERDUTY_CONTINUATION_FIXTURES: readonly PagerDutyContinuationFixture[];
+//# sourceMappingURL=pagerduty-continuation-fixtures.d.ts.map

package/dist/internal/testing/pagerduty-continuation-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagerduty-continuation-fixtures.d.ts","sourceRoot":"","sources":["../../../src/internal/testing/pagerduty-continuation-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAeD,6DAA6D;AAC7D,eAAO,MAAM,8BAA8B,YAAY,CAAC;AACxD,eAAO,MAAM,+BAA+B,YAAY,CAAC;AAEzD,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAO1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoB1B;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAY1B;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1B;AAID,eAAO,MAAM,+BAA+B,EAAE,SAAS,4BAA4B,EA0FlF,CAAC"}

package/dist/internal/testing/pagerduty-continuation-fixtures.js

@@ -0,0 +1,175 @@
+/**
+ * PagerDuty v3 webhook continuation fixtures shared by the two continuation
+ * vocabulary copies: `internal/continuation-identity.ts` (BDK) and the
+ * control plane's `agentSdkConversationIdentity.ts` (server-shared). Both
+ * suites import this module, so a payload shape or key format that only one
+ * copy understands fails CI on the other side.
+ *
+ * Pure data and payload builders: no imports, so the server-shared suite
+ * can load it by relative path without pulling `@cursor/bdk` into the
+ * control plane.
+ */
+const SERVICE = {
+    id: "PSVC001",
+    type: "service_reference",
+    summary: "checkout-api",
+    html_url: "https://acme.pagerduty.com/service-directory/PSVC001",
+};
+const ESCALATION_POLICY = {
+    id: "PPOL001",
+    type: "escalation_policy_reference",
+    summary: "checkout first responder",
+};
+/** The deployment's own PagerDuty user in these fixtures. */
+export const PAGERDUTY_FIXTURE_SELF_USER_ID = "PBOT001";
+export const PAGERDUTY_FIXTURE_HUMAN_USER_ID = "PHUM001";
+export function pagerDutyUserReference(id) {
+    return {
+        id,
+        type: "user_reference",
+        summary: id === PAGERDUTY_FIXTURE_SELF_USER_ID ? "Responder bot" : "Dana Oncall",
+        html_url: `https://acme.pagerduty.com/users/${id}`,
+    };
+}
+export function pagerDutyIncidentData(input) {
+    return {
+        id: input.id,
+        type: "incident",
+        self: `https://api.pagerduty.com/incidents/${input.id}`,
+        html_url: `https://acme.pagerduty.com/incidents/${input.id}`,
+        number: input.number ?? 4012,
+        status: input.status ?? "triggered",
+        incident_key: input.incidentKey,
+        created_at: "2026-10-12T09:45:01Z",
+        title: "checkout-api error rate above 5%",
+        service: SERVICE,
+        escalation_policy: ESCALATION_POLICY,
+        assignees: [pagerDutyUserReference(PAGERDUTY_FIXTURE_SELF_USER_ID)],
+        teams: [{ id: "PTEAM01", type: "team_reference", summary: "Checkout" }],
+        priority: { id: "PPRI001", type: "priority_reference", summary: "P2" },
+        urgency: "high",
+        conference_bridge: null,
+        resolve_reason: null,
+    };
+}
+export function pagerDutyIncidentReference(input) {
+    const reference = {
+        id: input.id,
+        type: "incident_reference",
+        self: `https://api.pagerduty.com/incidents/${input.id}`,
+        html_url: `https://acme.pagerduty.com/incidents/${input.id}`,
+        summary: "checkout-api error rate above 5%",
+    };
+    if (input.incidentKey !== undefined) {
+        reference.incident_key = input.incidentKey;
+    }
+    return reference;
+}
+/** One signed v3 delivery body: `{ event: { … } }`. */
+export function pagerDutyWebhookBody(input) {
+    return {
+        event: {
+            id: input.eventId ?? `01EVT${input.eventType.replace(/[^a-z]/g, "").toUpperCase()}`,
+            event_type: input.eventType,
+            resource_type: input.resourceType ?? "incident",
+            occurred_at: "2026-10-12T09:45:02.311Z",
+            agent: input.agentId === null
+                ? null
+                : pagerDutyUserReference(input.agentId ?? PAGERDUTY_FIXTURE_HUMAN_USER_ID),
+            client: { name: "PagerDuty" },
+            data: input.data,
+        },
+    };
+}
+const DEDUP_KEY = "datadog-monitor-81234567";
+export const PAGERDUTY_CONTINUATION_FIXTURES = [
+    {
+        name: "triggered incident keys on its id",
+        eventType: "incident.triggered",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.triggered",
+            agentId: null,
+            data: pagerDutyIncidentData({ id: "PINC001", incidentKey: DEDUP_KEY }),
+        }),
+        expectedKey: "cont:pagerduty:incident:PINC001",
+    },
+    {
+        name: "a re-trigger after resolve is a new incident and a new lane",
+        eventType: "incident.triggered",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.triggered",
+            agentId: null,
+            data: pagerDutyIncidentData({ id: "PINC002", incidentKey: DEDUP_KEY, number: 4013 }),
+        }),
+        expectedKey: "cont:pagerduty:incident:PINC002",
+    },
+    {
+        name: "a lifecycle event by a person stays on the incident",
+        eventType: "incident.acknowledged",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.acknowledged",
+            data: pagerDutyIncidentData({
+                id: "PINC001",
+                incidentKey: DEDUP_KEY,
+                status: "acknowledged",
+            }),
+        }),
+        expectedKey: "cont:pagerduty:incident:PINC001",
+    },
+    {
+        name: "an incident with no dedup key keys on its id",
+        eventType: "incident.triggered",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.triggered",
+            data: pagerDutyIncidentData({ id: "PMAN001", incidentKey: null }),
+        }),
+        expectedKey: "cont:pagerduty:incident:PMAN001",
+    },
+    {
+        name: "a note joins the incident it names, not the note id",
+        eventType: "incident.annotated",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.annotated",
+            data: {
+                id: "PNOTE01",
+                type: "incident_note",
+                content: "Rolled back the 09:30 deploy.",
+                trimmed: false,
+                incident: pagerDutyIncidentReference({ id: "PINC001" }),
+            },
+        }),
+        expectedKey: "cont:pagerduty:incident:PINC001",
+    },
+    {
+        name: "a responder event joins the incident it names",
+        eventType: "incident.responder.added",
+        payload: pagerDutyWebhookBody({
+            eventType: "incident.responder.added",
+            data: {
+                type: "incident_responder",
+                user: pagerDutyUserReference("PDBA001"),
+                escalation_policy: ESCALATION_POLICY,
+                message: "Please join the database investigation.",
+                state: "pending",
+                incident: pagerDutyIncidentReference({ id: "PINC001" }),
+            },
+        }),
+        expectedKey: "cont:pagerduty:incident:PINC001",
+    },
+    {
+        name: "a service event is outside the incident membership",
+        eventType: "service.updated",
+        payload: pagerDutyWebhookBody({
+            eventType: "service.updated",
+            resourceType: "service",
+            data: { ...SERVICE, type: "service" },
+        }),
+        expectedKey: undefined,
+    },
+    {
+        name: "an incident event without incident data stamps evt:",
+        eventType: "incident.triggered",
+        payload: pagerDutyWebhookBody({ eventType: "incident.triggered", data: null }),
+        expectedKey: undefined,
+    },
+];

package/dist/internal/update-check.d.ts

@@ -12,7 +12,7 @@
  * installed (global npm/pnpm/yarn/bun, or a project dependency), and runs the
  * matching install command.
  */
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 /**
  * Semver-style ordering: negative when `a < b`, 0 when equal, positive when
  * `a > b`. Unparseable versions compare equal (never warn on garbage).
@@ -30,7 +30,7 @@ export declare function fetchLatestPublishedVersion(options?: {
 declare const cacheSchema: z.ZodObject<{
     checkedAt: z.ZodNumber;
     latestVersion: z.ZodOptional<z.ZodString>;
-}, "strip">;
+}>;
 export type UpdateCheckCache = z.infer<typeof cacheSchema>;
 export declare function updateCheckCachePath(configDir?: string): string;
 export declare function readUpdateCheckCache(configDir?: string): Promise<UpdateCheckCache | undefined>;

package/dist/internal/update-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/internal/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AA2C3B;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA0C5D;AAQD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAC1D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB9B;AAMD,QAAA,MAAM,WAAW,EAAE,CAAC,CAAC,SAAS,CAC5B;IAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;CAAE,EACrE,OAAO,CAMP,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE3D,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAsB,oBAAoB,CACxC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAavC;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wCAAwC;IACxC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCnF;AAUD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA8DrC;AA4ED,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,iFAAiF;AACjF,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D3E"}
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/internal/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AA2C5B;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA0C5D;AAQD;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAC1D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB9B;AAMD,QAAA,MAAM,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;IACvB,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;CAC3C,CAKC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAE3D,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAsB,oBAAoB,CACxC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAavC;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAMD,MAAM,WAAW,qBAAqB;IACpC,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,wCAAwC;IACxC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCnF;AAUD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CA8DrC;AA4ED,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,iFAAiF;AACjF,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D3E"}

package/dist/internal/update-check.js

@@ -15,7 +15,7 @@
 import { spawn } from "node:child_process";
 import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, join, sep } from "node:path";
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 import { configDirPath } from "./cursor/credentials.js";
 import { describeError } from "./describe-error.js";
 import { CLI_COMMAND_NAME, isCompiledDistribution, PACKAGE_NAME, packageRootDir, packageVersion, } from "./distribution.js";
@@ -295,8 +295,8 @@ async function declaresDependency(dir, packageName) {
         return false;
     }
     const manifestSchema = z.object({
-        dependencies: z.record(z.string()).optional(),
-        devDependencies: z.record(z.string()).optional(),
+        dependencies: z.record(z.string(), z.string()).optional(),
+        devDependencies: z.record(z.string(), z.string()).optional(),
     });
     try {
         const parsed = manifestSchema.safeParse(JSON.parse(raw));

package/dist/internal/zod-schema.d.ts

@@ -0,0 +1,14 @@
+import type { ZodSchema, ZodV4Schema } from "../types.js";
+/**
+ * Authored schemas can come from a different zod copy than this package's,
+ * so the version check is structural (`_zod` marks zod 4), never
+ * `instanceof`.
+ */
+export declare function isZodV4Schema(schema: ZodSchema): schema is ZodV4Schema;
+/**
+ * `io: "input"` for data a caller sends in (fields with a default stay
+ * optional); `io: "output"` for data this side sends out. Unrepresentable
+ * types become `{}` rather than failing discovery, as the zod 3 converter did.
+ */
+export declare function zodV4ToJsonSchema(schema: ZodV4Schema, io: "input" | "output"): Record<string, unknown>;
+//# sourceMappingURL=zod-schema.d.ts.map

package/dist/internal/zod-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-schema.d.ts","sourceRoot":"","sources":["../../src/internal/zod-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,WAAW,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,WAAW,EACnB,EAAE,EAAE,OAAO,GAAG,QAAQ,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB"}

package/dist/internal/zod-schema.js

@@ -0,0 +1,22 @@
+import * as z4core from "zod/v4/core";
+/**
+ * Authored schemas can come from a different zod copy than this package's,
+ * so the version check is structural (`_zod` marks zod 4), never
+ * `instanceof`.
+ */
+export function isZodV4Schema(schema) {
+    return "_zod" in schema;
+}
+/**
+ * `io: "input"` for data a caller sends in (fields with a default stay
+ * optional); `io: "output"` for data this side sends out. Unrepresentable
+ * types become `{}` rather than failing discovery, as the zod 3 converter did.
+ */
+export function zodV4ToJsonSchema(schema, io) {
+    const params = { io, unrepresentable: "any" };
+    // Classic schemas carry their own converter; mini schemas do not.
+    const converted = "toJSONSchema" in schema && typeof schema.toJSONSchema === "function"
+        ? schema.toJSONSchema(params)
+        : z4core.toJSONSchema(schema, params);
+    return converted;
+}

package/dist/internal/zod3-datetime.d.ts

@@ -0,0 +1,12 @@
+import * as z from "zod/v4";
+/**
+ * The datetime check of zod 3's `z.string().datetime()`. zod 4 refuses times
+ * without seconds and, with `offset`, `+HHMM` offsets; models and people still
+ * type both. Use it for values a person or a model writes; a value that only
+ * `toISOString()` writes can keep `z.iso.datetime()`.
+ */
+export declare function zod3Datetime(options?: {
+    offset?: boolean;
+    message?: string;
+}): z.ZodString;
+//# sourceMappingURL=zod3-datetime.d.ts.map

package/dist/internal/zod3-datetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod3-datetime.d.ts","sourceRoot":"","sources":["../../src/internal/zod3-datetime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAM5B;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,CAAC,CAAC,SAAS,CAM9F"}

package/dist/internal/zod3-datetime.js

@@ -0,0 +1,17 @@
+import * as z from "zod/v4";
+const DATE = z.regexes.date.source.slice(1, -1);
+const TIME = String.raw `(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?`;
+const OFFSET = String.raw `[+-]\d{2}:?\d{2}`;
+/**
+ * The datetime check of zod 3's `z.string().datetime()`. zod 4 refuses times
+ * without seconds and, with `offset`, `+HHMM` offsets; models and people still
+ * type both. Use it for values a person or a model writes; a value that only
+ * `toISOString()` writes can keep `z.iso.datetime()`.
+ */
+export function zod3Datetime(options = {}) {
+    const zone = options.offset === true ? `(?:Z|${OFFSET})` : "Z";
+    return z
+        .string()
+        .regex(new RegExp(`^${DATE}T${TIME}${zone}$`), options.message ?? "Invalid datetime")
+        .meta({ format: "date-time" });
+}

package/dist/otel-public.d.ts

@@ -1,7 +1,6 @@
 /**
- * Public `@cursor/bdk/otel` surface: types and W3C `traceparent`
- * helpers. `defineOtel` is `@cursor/bdk/internal/otel`.
+ * Public `@cursor/bdk/otel` surface.
  */
-export type { OtelConfig, OtelConfigFactory, OtelDefinition, OtelExporterConfig, OtelLogOptions, OtelMetricOptions, OtelSignal, OtelTraceOptions, } from "./otel.js";
 export { activeTraceparent, BACKEND_TRACEPARENT_HEADER, formatTraceparent, injectActiveTraceContext, installOutboundFetchInstrumentation, instrumentedFetch, TRACEPARENT_HEADER, } from "./otel.js";
+export { currentConversationId } from "./internal/otel/conversation-span-processor.js";
 //# sourceMappingURL=otel-public.d.ts.map

package/dist/otel-public.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel-public.d.ts","sourceRoot":"","sources":["../src/otel-public.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,wBAAwB,EACxB,mCAAmC,EACnC,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"otel-public.d.ts","sourceRoot":"","sources":["../src/otel-public.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,wBAAwB,EACxB,mCAAmC,EACnC,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC"}

package/dist/otel-public.js

@@ -1,5 +1,5 @@
 /**
- * Public `@cursor/bdk/otel` surface: types and W3C `traceparent`
- * helpers. `defineOtel` is `@cursor/bdk/internal/otel`.
+ * Public `@cursor/bdk/otel` surface.
  */
 export { activeTraceparent, BACKEND_TRACEPARENT_HEADER, formatTraceparent, injectActiveTraceContext, installOutboundFetchInstrumentation, instrumentedFetch, TRACEPARENT_HEADER, } from "./otel.js";
+export { currentConversationId } from "./internal/otel/conversation-span-processor.js";

package/dist/otel.d.ts

@@ -1,106 +1,7 @@
 /**
- * OpenTelemetry for Agent SDK — author `agent/otel.ts`, pass `serve({ otel })`,
- * or set `OTEL_EXPORTER_OTLP_ENDPOINT` (standard OTel env).
- *
- * ```ts
- * import { defineOtel } from "@cursor/bdk/internal/otel";
- *
- * export default defineOtel({
- *   serviceName: "cursor",
- *   exporters: [{ url: "https://otel.example.com", protocol: "http/protobuf" }],
- * });
- *
- * export default defineOtel(() => resolveMyOtelConfig());
- * ```
- *
- * Internal only: Cursor factory agents. Not a public Agent SDK export.
- */
-export type OtelSignal = "traces" | "metrics" | "logs";
-/** One OTLP destination. Multiple entries fan out. */
-export interface OtelExporterConfig {
-    /**
-     * OTLP base URL (`https://otel.example.com`) or signal path
-     * (`…/v1/traces`). Signal paths are stripped to the base; the runtime
-     * re-appends `/v1/{signal}`.
-     */
-    url: string;
-    /** Extra HTTP headers (merged with `OTEL_EXPORTER_OTLP_HEADERS`). */
-    headers?: Record<string, string>;
-    /**
-     * Wire format. Default `http/protobuf` (matches Cursor enterprise OTLP).
-     * Use `http/json` for collectors that only accept JSON.
-     */
-    protocol?: "http/json" | "http/protobuf";
-    /**
-     * Restrict this destination to these signals. Default: all enabled
-     * signals. Set by env when per-signal `OTEL_EXPORTER_OTLP_*_ENDPOINT`
-     * vars differ.
-     */
-    signals?: OtelSignal[];
-}
-export interface OtelTraceOptions {
-    /** Sample ratio in `[0, 1]`. Default `1`. */
-    sampleRatio?: number;
-}
-export interface OtelMetricOptions {
-    /** Export interval in ms. Default `10000`. */
-    exportIntervalMillis?: number;
-}
-export interface OtelLogOptions {
-    /**
-     * Include user prompt text on log records / span events.
-     * Default false; also toggled by `OTEL_LOG_USER_PROMPTS=1`.
-     */
-    userPrompts?: boolean;
-    /**
-     * Include tool argument / result payloads and failure text (truncated).
-     * Default false; also `OTEL_LOG_TOOL_CONTENT=1`.
-     */
-    toolContent?: boolean;
-}
-/**
- * Authored / programmatic OTel config. Empty config still enables when
- * standard `OTEL_EXPORTER_OTLP_*` env vars are set.
- */
-export interface OtelConfig {
-    /**
-     * Resource `service.name`. Default: `OTEL_SERVICE_NAME` or `"cursor"`
-     * (same as enterprise export) so Agent SDK signals join org streams.
-     */
-    serviceName?: string;
-    /** Resource `service.version`. */
-    serviceVersion?: string;
-    /** Extra resource attributes on every signal. */
-    resourceAttributes?: Record<string, string>;
-    /**
-     * OTLP destinations. Default: from `OTEL_EXPORTER_OTLP_ENDPOINT` /
-     * per-signal `*_TRACES_ENDPOINT` etc. Empty with no env = disabled.
-     */
-    exporters?: OtelExporterConfig[];
-    /** Traces on/off or options. Default on. */
-    traces?: boolean | OtelTraceOptions;
-    /** Metrics on/off or options. Default on. */
-    metrics?: boolean | OtelMetricOptions;
-    /** Logs on/off or options. Default off (opt-in content). */
-    logs?: boolean | OtelLogOptions;
-}
-export type OtelDefinition = OtelConfig & {
-    readonly __agentServe: "otel";
-};
-/** Re-read authored config on each hosted request, after secrets load. */
-export type OtelConfigFactory = () => OtelConfig;
-/**
- * Hidden factory on {@link OtelDefinition}. Not enumerable so
- * `pickAuthoredOtel` compares the bake-time snapshot, not the thunk.
- */
-export declare const OTEL_CONFIG_RESOLVE: symbol;
-/**
- * Author OpenTelemetry export under `agent/otel.ts`.
- * Import from `@cursor/bdk/internal/otel`, not `@cursor/bdk`.
+ * W3C `traceparent` helpers for outbound calls.
+ * Set `OTEL_*` variables. There is no instrumentation file.
  */
-export declare function defineOtel(config?: OtelConfig | OtelConfigFactory): OtelDefinition;
-/** Invoke a `defineOtel(() => …)` factory, or return the static snapshot. */
-export declare function resolveOtelDefinition(def: OtelConfig): OtelConfig;
 export declare const TRACEPARENT_HEADER = "traceparent";
 /** Cursor backend prefers this; `remoteSpanContextFromRequest` falls back to W3C. */
 export declare const BACKEND_TRACEPARENT_HEADER = "backend-traceparent";
@@ -125,6 +26,6 @@ export declare function injectActiveTraceContext(headers: {
 /** W3C `traceparent` for the active span, or undefined if none. */
 export declare function activeTraceparent(): string | undefined;
 export declare function instrumentedFetch(base?: typeof fetch): typeof fetch;
-/** Idempotent. Safe to call from `createOtelRuntime` on every serve. */
+/** Idempotent. Safe to call on every serve. */
 export declare function installOutboundFetchInstrumentation(): void;
 //# sourceMappingURL=otel.d.ts.map

package/dist/otel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../src/otel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAEvD,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,EAAE,WAAW,GAAG,eAAe,CAAC;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC,4CAA4C;IAC5C,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACpC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC;IACtC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAwD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,GAAE,UAAU,GAAG,iBAAsB,GAAG,cAAc,CAUtF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAUjE;AAuDD,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAChD,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,GAAG,IAAI,CAWP;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAItD;AAqBD,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,OAAO,KAAa,GAAG,OAAO,KAAK,CAQ1E;AAID,wEAAwE;AACxE,wBAAgB,mCAAmC,IAAI,IAAI,CAO1D"}
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../src/otel.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAChD,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC,GAAG,IAAI,CAWP;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAItD;AAoBD,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,OAAO,KAAa,GAAG,OAAO,KAAK,CAS1E;AAiED,+CAA+C;AAC/C,wBAAgB,mCAAmC,IAAI,IAAI,CAO1D"}