@cursor/bdk 0.2.9 → 0.2.10

package/dist/internal/cli-manifest.js

@@ -7,43 +7,31 @@
  * events, egress domains, public routes, and the full `/v1/info` payload.
  * Runs entirely offline — no VM, no engine, no network.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { buildAgentDeployManifest, parseAgentDeployManifest } from "./deploy-manifest.js";
 import { isAgentProjectDir, loadAgentProject } from "./discovery.js";
-export function cmdManifest(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((line) => process.stdout.write(line));
-        const err = (_b = options.err) !== null && _b !== void 0 ? _b : ((line) => process.stderr.write(line));
-        if (!(yield isAgentProjectDir(options.dir))) {
-            err(`No agent project found at ${options.dir} (expected an agent.ts default-exporting defineAgent({ ... })).\n`);
-            return 1;
-        }
-        const project = yield loadAgentProject(options.dir);
-        for (const diagnostic of project.diagnostics) {
-            err(`${diagnostic.severity}: ${diagnostic.message}\n`);
-        }
-        if (project.diagnostics.some(d => d.severity === "error")) {
-            return 1;
-        }
-        const manifest = buildAgentDeployManifest(project);
-        // Round-trip through the wire schema so `july manifest` can never emit
-        // something the control plane contract would reject.
-        if (parseAgentDeployManifest(JSON.parse(JSON.stringify(manifest))) === undefined) {
-            err("internal error: generated manifest failed schema validation\n");
-            return 1;
-        }
-        out(options.json === true
-            ? `${JSON.stringify(manifest)}\n`
-            : `${JSON.stringify(manifest, null, 2)}\n`);
-        return 0;
-    });
+export async function cmdManifest(options) {
+    const out = options.out ?? ((line) => process.stdout.write(line));
+    const err = options.err ?? ((line) => process.stderr.write(line));
+    if (!(await isAgentProjectDir(options.dir))) {
+        err(`No agent project found at ${options.dir} (expected an agent.ts default-exporting defineAgent({ ... })).\n`);
+        return 1;
+    }
+    const project = await loadAgentProject(options.dir);
+    for (const diagnostic of project.diagnostics) {
+        err(`${diagnostic.severity}: ${diagnostic.message}\n`);
+    }
+    if (project.diagnostics.some(d => d.severity === "error")) {
+        return 1;
+    }
+    const manifest = buildAgentDeployManifest(project);
+    // Round-trip through the wire schema so `july manifest` can never emit
+    // something the control plane contract would reject.
+    if (parseAgentDeployManifest(JSON.parse(JSON.stringify(manifest))) === undefined) {
+        err("internal error: generated manifest failed schema validation\n");
+        return 1;
+    }
+    out(options.json === true
+        ? `${JSON.stringify(manifest)}\n`
+        : `${JSON.stringify(manifest, null, 2)}\n`);
+    return 0;
 }

package/dist/internal/cli-mcp-oauth.js

@@ -7,15 +7,6 @@
  * stored backend-side against the hosted deployment's service account — see
  * `cursor-account-mcp-auth.ts`).
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
@@ -44,56 +35,53 @@ function describe(error) {
     const detail = code === undefined ? cause.message : `${cause.message} (${code})`;
     return `${error.message}: ${detail}`;
 }
-export function cmdMcpOauth(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        const err = (_a = options.err) !== null && _a !== void 0 ? _a : (text => process.stderr.write(text));
-        const out = (_b = options.out) !== null && _b !== void 0 ? _b : (text => process.stdout.write(text));
-        const project = yield loadAgentProject(options.dir);
-        const authored = [...project.agent.connections, ...((_c = project.agent.hostConnections) !== null && _c !== void 0 ? _c : [])];
-        const connection = authored.find(entry => entry.name === options.connection);
-        if (connection === undefined) {
-            const known = authored.map(entry => entry.name).join(", ") || "(none)";
-            err(`${LOG_PREFIX} Unknown MCP connection "${options.connection}". Authored: ${known}.\n`);
-            return 1;
-        }
-        const transport = resolveConnectionEnvTemplates(connection.transport);
-        if (isCursorAccountTransport(transport)) {
-            return cmdMcpOauthCursorAccount(options, {
-                servers: transport.servers,
-                out,
-                err,
-            });
-        }
-        if (!("url" in transport) || transport.oauth !== true) {
-            err(`${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }) or defineConnection({ cursorAccount: true }).\n`);
-            return 1;
-        }
-        const flow = yield authorizeHostMcpOauth({
-            connection: options.connection,
-            url: transport.url,
-            type: transport.type === "sse" ? "sse" : "http",
-            headers: transport.headers,
+export async function cmdMcpOauth(options) {
+    const err = options.err ?? (text => process.stderr.write(text));
+    const out = options.out ?? (text => process.stdout.write(text));
+    const project = await loadAgentProject(options.dir);
+    const authored = [...project.agent.connections, ...(project.agent.hostConnections ?? [])];
+    const connection = authored.find(entry => entry.name === options.connection);
+    if (connection === undefined) {
+        const known = authored.map(entry => entry.name).join(", ") || "(none)";
+        err(`${LOG_PREFIX} Unknown MCP connection "${options.connection}". Authored: ${known}.\n`);
+        return 1;
+    }
+    const transport = resolveConnectionEnvTemplates(connection.transport);
+    if (isCursorAccountTransport(transport)) {
+        return cmdMcpOauthCursorAccount(options, {
+            servers: transport.servers,
             out,
             err,
         });
-        if (!flow.ok) {
-            return 1;
-        }
-        if (options.store !== true) {
-            return 0;
-        }
-        return storeOauthSecrets({
-            connection: options.connection,
-            dir: options.dir,
-            slug: options.slug,
-            team: options.team,
-            apiKey: options.apiKey,
-            tokens: flow.tokens,
-            clientId: flow.clientId,
-            err,
-            out,
-        });
+    }
+    if (!("url" in transport) || transport.oauth !== true) {
+        err(`${LOG_PREFIX} "${options.connection}" must be defineConnection({ url, oauth: true }) or defineConnection({ cursorAccount: true }).\n`);
+        return 1;
+    }
+    const flow = await authorizeHostMcpOauth({
+        connection: options.connection,
+        url: transport.url,
+        type: transport.type === "sse" ? "sse" : "http",
+        headers: transport.headers,
+        out,
+        err,
+    });
+    if (!flow.ok) {
+        return 1;
+    }
+    if (options.store !== true) {
+        return 0;
+    }
+    return storeOauthSecrets({
+        connection: options.connection,
+        dir: options.dir,
+        slug: options.slug,
+        team: options.team,
+        apiKey: options.apiKey,
+        tokens: flow.tokens,
+        clientId: flow.clientId,
+        err,
+        out,
     });
 }
 /**
@@ -101,219 +89,212 @@ export function cmdMcpOauth(options) {
  * the transport metadata directly so callers that already hold it never have
  * to load the authored project to authorize.
  */
-export function authorizeHostMcpOauth(args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { connection, out, err } = args;
-        out(`${LOG_PREFIX} Authorizing "${connection}" (${args.url})…\n`);
-        let authorizationUrl;
-        const provider = yield createHostMcpOAuthProvider({
-            identifier: connection,
-            resourceUrl: args.url,
-            onRedirect: url => {
-                authorizationUrl = url;
-            },
-        });
-        const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
-        const url = new URL(args.url);
-        const requestInit = args.headers === undefined ? undefined : { headers: args.headers };
-        const makeTransport = () => {
-            if (args.type === "sse") {
-                return new SSEClientTransport(url, {
-                    authProvider: provider,
-                    requestInit,
-                });
-            }
-            return new StreamableHTTPClientTransport(url, {
+export async function authorizeHostMcpOauth(args) {
+    const { connection, out, err } = args;
+    out(`${LOG_PREFIX} Authorizing "${connection}" (${args.url})…\n`);
+    let authorizationUrl;
+    const provider = await createHostMcpOAuthProvider({
+        identifier: connection,
+        resourceUrl: args.url,
+        onRedirect: url => {
+            authorizationUrl = url;
+        },
+    });
+    const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
+    const url = new URL(args.url);
+    const requestInit = args.headers === undefined ? undefined : { headers: args.headers };
+    const makeTransport = () => {
+        if (args.type === "sse") {
+            return new SSEClientTransport(url, {
                 authProvider: provider,
                 requestInit,
             });
-        };
-        let mcpTransport = makeTransport();
-        let authorized = false;
-        try {
-            yield client.connect(mcpTransport);
-            out(`${LOG_PREFIX} "${connection}" already authorized.\n`);
-            yield client.close().catch(() => undefined);
-            authorized = true;
         }
-        catch (error) {
-            if (!(error instanceof UnauthorizedError)) {
-                err(`${LOG_PREFIX} Failed to connect to "${connection}": ${describe(error)}\n`);
-                return { ok: false };
-            }
+        return new StreamableHTTPClientTransport(url, {
+            authProvider: provider,
+            requestInit,
+        });
+    };
+    let mcpTransport = makeTransport();
+    let authorized = false;
+    try {
+        await client.connect(mcpTransport);
+        out(`${LOG_PREFIX} "${connection}" already authorized.\n`);
+        await client.close().catch(() => undefined);
+        authorized = true;
+    }
+    catch (error) {
+        if (!(error instanceof UnauthorizedError)) {
+            err(`${LOG_PREFIX} Failed to connect to "${connection}": ${describe(error)}\n`);
+            return { ok: false };
         }
-        if (!authorized) {
-            const redirect = authorizationUrl !== null && authorizationUrl !== void 0 ? authorizationUrl : provider.lastRedirectUrl;
-            if (redirect === undefined) {
-                err(`${LOG_PREFIX} Auth required but no authorization URL was provided.\n`);
-                return { ok: false };
-            }
-            out(`${LOG_PREFIX} Open if needed:\n  ${redirect.toString()}\n`);
-            out(`${LOG_PREFIX} Waiting on ${MCP_OAUTH_CALLBACK_URL}…\n`);
-            openBrowser(redirect.toString());
-            let callback;
-            try {
-                callback = yield waitForMcpOAuthCallback({
-                    authorizationUrl: redirect.toString(),
-                });
-            }
-            catch (error) {
-                err(`${LOG_PREFIX} OAuth callback failed: ${describe(error)}\n`);
-                return { ok: false };
-            }
-            try {
-                yield mcpTransport.finishAuth(callback.code);
-            }
-            catch (error) {
-                err(`${LOG_PREFIX} Token exchange failed: ${describe(error)}\n`);
-                return { ok: false };
-            }
-            mcpTransport = makeTransport();
-            try {
-                yield client.connect(mcpTransport);
-                const tools = yield client.listTools();
-                out(`${LOG_PREFIX} Authorized "${connection}" (${tools.tools.length} tools). Local tokens in the agent-serve config dir.\n`);
-                yield client.close().catch(() => undefined);
-            }
-            catch (error) {
-                err(`${LOG_PREFIX} Reconnect failed: ${describe(error)}. Re-run \`${CLI} mcp oauth ${connection}\`.\n`);
-                return { ok: false };
-            }
+    }
+    if (!authorized) {
+        const redirect = authorizationUrl ?? provider.lastRedirectUrl;
+        if (redirect === undefined) {
+            err(`${LOG_PREFIX} Auth required but no authorization URL was provided.\n`);
+            return { ok: false };
         }
-        return {
-            ok: true,
-            tokens: provider.tokens(),
-            clientId: (_a = provider.clientInformation()) === null || _a === void 0 ? void 0 : _a.client_id,
-        };
-    });
-}
-/**
- * `mcp oauth` for a `cursorAccount` connection: authorize the hosted
- * deployment's service account for the connection's connectors. Tokens are
- * stored backend-side by the cursor.com OAuth callback, so `--store` (a
- * deployment-secrets concept) is a no-op here.
- */
-function cmdMcpOauthCursorAccount(options, args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const { out, err } = args;
-        let slug;
+        out(`${LOG_PREFIX} Open if needed:\n  ${redirect.toString()}\n`);
+        out(`${LOG_PREFIX} Waiting on ${MCP_OAUTH_CALLBACK_URL}…\n`);
+        openBrowser(redirect.toString());
+        let callback;
         try {
-            slug = resolveProdSlug({ dir: options.dir, slug: options.slug });
+            callback = await waitForMcpOAuthCallback({
+                authorizationUrl: redirect.toString(),
+            });
         }
         catch (error) {
-            err(`${LOG_PREFIX} ${describe(error)}\n`);
-            return 1;
+            err(`${LOG_PREFIX} OAuth callback failed: ${describe(error)}\n`);
+            return { ok: false };
         }
-        const auth = yield resolveDeployAuth({
-            team: options.team,
-            apiKey: options.apiKey,
-            fetchImpl: options.fetchImpl,
-            err,
-        });
-        if (typeof auth === "number") {
-            return auth;
-        }
-        const backendClient = new CursorBackendClient({
-            backendUrl: auth.backendUrl,
-            apiKey: auth.apiKey,
-            fetchImpl: options.fetchImpl,
-        });
-        let serviceAccountId;
         try {
-            yield rejectV2ForLegacyCommand({
-                client: auth.client,
-                teamId: auth.teamId,
-                slug,
-            });
-            const detail = yield auth.client.getDeployment({
-                teamId: auth.teamId,
-                slug,
-            });
-            serviceAccountId = deploymentServiceAccountId(detail);
+            await mcpTransport.finishAuth(callback.code);
         }
         catch (error) {
-            if (isUnsupportedV2LegacyCommandError(error)) {
-                err(`${LOG_PREFIX} ${error.message}\n`);
-                return 1;
-            }
-            err(`${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
-                `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`);
-            return 1;
+            err(`${LOG_PREFIX} Token exchange failed: ${describe(error)}\n`);
+            return { ok: false };
         }
-        if (serviceAccountId === undefined) {
-            err(`${LOG_PREFIX} Deployment "${slug}" has no service account yet (it predates service-account-backed deploys). Redeploy with \`${CLI} deploy\` and rerun.\n`);
-            return 1;
+        mcpTransport = makeTransport();
+        try {
+            await client.connect(mcpTransport);
+            const tools = await client.listTools();
+            out(`${LOG_PREFIX} Authorized "${connection}" (${tools.tools.length} tools). Local tokens in the agent-serve config dir.\n`);
+            await client.close().catch(() => undefined);
         }
-        if (options.store === true) {
-            out(`${LOG_PREFIX} Note: --store is not needed for cursorAccount connections — tokens are stored on the Cursor backend against the deployment's service account.\n`);
+        catch (error) {
+            err(`${LOG_PREFIX} Reconnect failed: ${describe(error)}. Re-run \`${CLI} mcp oauth ${connection}\`.\n`);
+            return { ok: false };
         }
-        out(`${LOG_PREFIX} Authorizing connection "${options.connection}" for ${slug}'s service account…\n`);
-        const result = yield authorizeCursorAccountConnectors({
-            backendClient,
+    }
+    return {
+        ok: true,
+        tokens: provider.tokens(),
+        clientId: provider.clientInformation()?.client_id,
+    };
+}
+/**
+ * `mcp oauth` for a `cursorAccount` connection: authorize the hosted
+ * deployment's service account for the connection's connectors. Tokens are
+ * stored backend-side by the cursor.com OAuth callback, so `--store` (a
+ * deployment-secrets concept) is a no-op here.
+ */
+async function cmdMcpOauthCursorAccount(options, args) {
+    const { out, err } = args;
+    let slug;
+    try {
+        slug = resolveProdSlug({ dir: options.dir, slug: options.slug });
+    }
+    catch (error) {
+        err(`${LOG_PREFIX} ${describe(error)}\n`);
+        return 1;
+    }
+    const auth = await resolveDeployAuth({
+        team: options.team,
+        apiKey: options.apiKey,
+        fetchImpl: options.fetchImpl,
+        err,
+    });
+    if (typeof auth === "number") {
+        return auth;
+    }
+    const backendClient = new CursorBackendClient({
+        backendUrl: auth.backendUrl,
+        apiKey: auth.apiKey,
+        fetchImpl: options.fetchImpl,
+    });
+    let serviceAccountId;
+    try {
+        await rejectV2ForLegacyCommand({
+            client: auth.client,
             teamId: auth.teamId,
             slug,
-            serviceAccountId,
-            connectionName: options.connection,
-            servers: args.servers,
-            interactive: true,
-            out,
-            err,
-            openBrowserImpl: options.openBrowserImpl,
-            sleep: options.sleep,
-            pollIntervalMs: options.pollIntervalMs,
-            pollTimeoutMs: options.pollTimeoutMs,
         });
-        if (result.pending.length > 0 || result.errored.length > 0) {
-            err(`${LOG_PREFIX} You can authorize connectors any time from the playground page ` +
-                `(cursor.com dashboard → Deployed Agents → ${slug}) or by rerunning ` +
-                `\`${CLI} mcp oauth ${options.connection}\`.\n`);
+        const detail = await auth.client.getDeployment({
+            teamId: auth.teamId,
+            slug,
+        });
+        serviceAccountId = deploymentServiceAccountId(detail);
+    }
+    catch (error) {
+        if (isUnsupportedV2LegacyCommandError(error)) {
+            err(`${LOG_PREFIX} ${error.message}\n`);
             return 1;
         }
-        return 0;
+        err(`${LOG_PREFIX} Could not load deployment "${slug}" (team ${auth.teamId}): ${describe(error)}\n` +
+            `${LOG_PREFIX} Deploy first with \`${CLI} deploy\`.\n`);
+        return 1;
+    }
+    if (serviceAccountId === undefined) {
+        err(`${LOG_PREFIX} Deployment "${slug}" has no service account yet (it predates service-account-backed deploys). Redeploy with \`${CLI} deploy\` and rerun.\n`);
+        return 1;
+    }
+    if (options.store === true) {
+        out(`${LOG_PREFIX} Note: --store is not needed for cursorAccount connections — tokens are stored on the Cursor backend against the deployment's service account.\n`);
+    }
+    out(`${LOG_PREFIX} Authorizing connection "${options.connection}" for ${slug}'s service account…\n`);
+    const result = await authorizeCursorAccountConnectors({
+        backendClient,
+        teamId: auth.teamId,
+        slug,
+        serviceAccountId,
+        connectionName: options.connection,
+        servers: args.servers,
+        interactive: true,
+        out,
+        err,
+        openBrowserImpl: options.openBrowserImpl,
+        sleep: options.sleep,
+        pollIntervalMs: options.pollIntervalMs,
+        pollTimeoutMs: options.pollTimeoutMs,
     });
+    if (result.pending.length > 0 || result.errored.length > 0) {
+        err(`${LOG_PREFIX} You can authorize connectors any time from the playground page ` +
+            `(cursor.com dashboard → Deployed Agents → ${slug}) or by rerunning ` +
+            `\`${CLI} mcp oauth ${options.connection}\`.\n`);
+        return 1;
+    }
+    return 0;
 }
-function storeOauthSecrets(args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const tokens = args.tokens;
-        if (tokens === undefined || tokens.access_token.trim() === "") {
-            args.err(`${LOG_PREFIX} No access token to store for "${args.connection}".\n`);
-            return 1;
-        }
-        let slug;
-        try {
-            slug = resolveProdSlug({ dir: args.dir, slug: args.slug });
-        }
-        catch (error) {
-            args.err(`${LOG_PREFIX} ${describe(error)}\n`);
-            return 1;
-        }
-        const auth = yield resolveDeployAuth({
-            team: args.team,
-            apiKey: args.apiKey,
-            err: args.err,
-        });
-        if (typeof auth === "number") {
-            return auth;
-        }
-        try {
-            yield rejectV2ForLegacyCommand({
-                client: auth.client,
-                teamId: auth.teamId,
-                slug,
-            });
-            const secretNames = yield upsertHostMcpOauthSecrets({
-                connection: args.connection,
-                tokens,
-                clientId: args.clientId,
-                target: { client: auth.client, teamId: auth.teamId, slug },
-            });
-            args.out(`${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
-            return 0;
-        }
-        catch (error) {
-            args.err(`${LOG_PREFIX} Failed to store secrets on ${slug}: ${describe(error)}\n`);
-            return 1;
-        }
+async function storeOauthSecrets(args) {
+    const tokens = args.tokens;
+    if (tokens === undefined || tokens.access_token.trim() === "") {
+        args.err(`${LOG_PREFIX} No access token to store for "${args.connection}".\n`);
+        return 1;
+    }
+    let slug;
+    try {
+        slug = resolveProdSlug({ dir: args.dir, slug: args.slug });
+    }
+    catch (error) {
+        args.err(`${LOG_PREFIX} ${describe(error)}\n`);
+        return 1;
+    }
+    const auth = await resolveDeployAuth({
+        team: args.team,
+        apiKey: args.apiKey,
+        err: args.err,
     });
+    if (typeof auth === "number") {
+        return auth;
+    }
+    try {
+        await rejectV2ForLegacyCommand({
+            client: auth.client,
+            teamId: auth.teamId,
+            slug,
+        });
+        const secretNames = await upsertHostMcpOauthSecrets({
+            connection: args.connection,
+            tokens,
+            clientId: args.clientId,
+            target: { client: auth.client, teamId: auth.teamId, slug },
+        });
+        args.out(`${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
+        return 0;
+    }
+    catch (error) {
+        args.err(`${LOG_PREFIX} Failed to store secrets on ${slug}: ${describe(error)}\n`);
+        return 1;
+    }
 }