@cursor/bdk 0.2.9 → 0.2.10

package/dist/internal/cursor/bound-secret-file.js

@@ -28,12 +28,12 @@ export function boundSecretFileIsReadable(path) {
     try {
         return readFileSync(path, "utf8").trim() !== "";
     }
-    catch (_a) {
+    catch {
         return false;
     }
 }
 function errorReason(error) {
-    const code = error === null || error === void 0 ? void 0 : error.code;
+    const code = error?.code;
     return typeof code === "string" ? code : "unknown";
 }
 /**
@@ -50,7 +50,7 @@ export function destroyBoundSecretFile(path) {
         try {
             unlinkSync(path);
         }
-        catch (_a) {
+        catch {
             // Already gone, or a directory the guest cannot write. Both are fine.
         }
         return { state: "absent" };

package/dist/internal/cursor/credentials.js

@@ -21,15 +21,6 @@
  * cross-tool credential sharing here: short-lived access tokens are minted
  * on demand from the API key (see `backend-client.ts`).
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
@@ -49,8 +40,9 @@ const DEFAULT_CURSOR_WEBSITE_URL = "https://cursor.com";
  * which reads the generic `CURSOR_BACKEND_URL` for its own hosts.
  */
 export function cursorBackendUrl() {
-    var _a, _b;
-    return trimTrailingSlash((_b = (_a = process.env.AGENT_SERVE_CURSOR_BACKEND_URL) !== null && _a !== void 0 ? _a : process.env.CURSOR_API_BASE_URL) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_BACKEND_URL);
+    return trimTrailingSlash(process.env.AGENT_SERVE_CURSOR_BACKEND_URL ??
+        process.env.CURSOR_API_BASE_URL ??
+        DEFAULT_CURSOR_BACKEND_URL);
 }
 /**
  * External API base URL for routes served only by the external-api
@@ -61,13 +53,11 @@ export function cursorBackendUrl() {
  * one server mounts all routes.
  */
 export function cursorExternalApiUrl() {
-    var _a;
-    return trimTrailingSlash((_a = process.env.CURSOR_API_BASE_URL) !== null && _a !== void 0 ? _a : DEFAULT_CURSOR_EXTERNAL_API_URL);
+    return trimTrailingSlash(process.env.CURSOR_API_BASE_URL ?? DEFAULT_CURSOR_EXTERNAL_API_URL);
 }
 /** Website base URL for the login deep link (`CURSOR_WEBSITE_URL` override). */
 export function cursorWebsiteUrl() {
-    var _a;
-    return trimTrailingSlash((_a = process.env.CURSOR_WEBSITE_URL) !== null && _a !== void 0 ? _a : DEFAULT_CURSOR_WEBSITE_URL);
+    return trimTrailingSlash(process.env.CURSOR_WEBSITE_URL ?? DEFAULT_CURSOR_WEBSITE_URL);
 }
 export function cloudAgentUrl(agentId) {
     return `${cursorWebsiteUrl()}/agents/${agentId}`;
@@ -89,8 +79,8 @@ const storedCredentialsSchema = z.object({
  * `AGENT_SERVE_CONFIG_DIR` pins the directory outright (tests, containers).
  */
 export function configDirPath() {
-    var _a, _b;
-    return ((_a = process.env.AGENT_SERVE_CONFIG_DIR) !== null && _a !== void 0 ? _a : join((_b = process.env.XDG_CONFIG_HOME) !== null && _b !== void 0 ? _b : join(homedir(), ".config"), "agent-serve"));
+    return (process.env.AGENT_SERVE_CONFIG_DIR ??
+        join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "agent-serve"));
 }
 /** `<configDir>/credentials.json` (0600). */
 export function credentialsFilePath() {
@@ -101,7 +91,7 @@ function parseStoredCredentialsJson(raw) {
     try {
         parsed = JSON.parse(raw);
     }
-    catch (_a) {
+    catch {
         return undefined;
     }
     const credentials = storedCredentialsSchema.safeParse(parsed);
@@ -118,44 +108,38 @@ export function readStoredCredentialsSync() {
     try {
         raw = readFileSync(credentialsFilePath(), "utf8");
     }
-    catch (_a) {
+    catch {
         return undefined;
     }
     return parseStoredCredentialsJson(raw);
 }
-export function readStoredCredentials() {
-    return __awaiter(this, void 0, void 0, function* () {
-        let raw;
-        try {
-            raw = yield readFile(credentialsFilePath(), "utf8");
-        }
-        catch (_a) {
-            return undefined;
-        }
-        return parseStoredCredentialsJson(raw);
-    });
+export async function readStoredCredentials() {
+    let raw;
+    try {
+        raw = await readFile(credentialsFilePath(), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    return parseStoredCredentialsJson(raw);
 }
-export function writeStoredCredentials(credentials) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const path = credentialsFilePath();
-        yield mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        yield writeFile(path, `${JSON.stringify(credentials, null, 2)}\n`, {
-            mode: 0o600,
-        });
-        // writeFile mode only applies on create; clamp pre-existing files too.
-        yield chmod(path, 0o600);
+export async function writeStoredCredentials(credentials) {
+    const path = credentialsFilePath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(credentials, null, 2)}\n`, {
+        mode: 0o600,
     });
+    // writeFile mode only applies on create; clamp pre-existing files too.
+    await chmod(path, 0o600);
 }
-export function clearStoredCredentials() {
-    return __awaiter(this, void 0, void 0, function* () {
-        try {
-            yield rm(credentialsFilePath());
-            return true;
-        }
-        catch (_a) {
-            return false;
-        }
-    });
+export async function clearStoredCredentials() {
+    try {
+        await rm(credentialsFilePath());
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * Hosted task-bind path. Not a secret: the snapshot may name this path.
@@ -173,7 +157,7 @@ export const DEFAULT_CURSOR_API_KEY_FILE = "/run/cursor/secrets/CURSOR_API_KEY";
  * env or login.
  */
 export function resolveCursorApiKeyFilePath(filePath, env = process.env) {
-    const configured = filePath !== null && filePath !== void 0 ? filePath : env.CURSOR_API_KEY_FILE;
+    const configured = filePath ?? env.CURSOR_API_KEY_FILE;
     return configured !== undefined && configured.trim() !== ""
         ? configured.trim()
         : DEFAULT_CURSOR_API_KEY_FILE;
@@ -184,7 +168,7 @@ export function readApiKeyFromFile(filePath) {
         const raw = readFileSync(path, "utf8").trim();
         return raw === "" ? undefined : raw;
     }
-    catch (_a) {
+    catch {
         return undefined;
     }
 }
@@ -207,15 +191,14 @@ export function readApiKeyFromFile(filePath) {
  * must fail the request rather than run authored code.
  */
 export function consumeBoundCursorApiKey(options) {
-    var _a;
-    const env = (_a = options === null || options === void 0 ? void 0 : options.env) !== null && _a !== void 0 ? _a : process.env;
-    const path = resolveCursorApiKeyFilePath(options === null || options === void 0 ? void 0 : options.filePath, env);
+    const env = options?.env ?? process.env;
+    const path = resolveCursorApiKeyFilePath(options?.filePath, env);
     const envKeyAlreadySet = env.CURSOR_API_KEY !== undefined && env.CURSOR_API_KEY.trim() !== "";
     let raw = "";
     try {
         raw = readFileSync(path, "utf8").trim();
     }
-    catch (_b) {
+    catch {
         return { applied: false, disposal: { state: "absent" } };
     }
     if (raw === "") {
@@ -249,9 +232,8 @@ function presentEnvKey(name) {
  * key wins over a leftover personal login.
  */
 export function resolveApiKeySync(options) {
-    var _a;
-    const backendUrl = (_a = options === null || options === void 0 ? void 0 : options.backendUrl) !== null && _a !== void 0 ? _a : cursorBackendUrl();
-    if ((options === null || options === void 0 ? void 0 : options.apiKey) !== undefined && options.apiKey.trim() !== "") {
+    const backendUrl = options?.backendUrl ?? cursorBackendUrl();
+    if (options?.apiKey !== undefined && options.apiKey.trim() !== "") {
         return { apiKey: options.apiKey.trim(), source: "option", backendUrl };
     }
     const envKey = presentEnvKey("CURSOR_API_KEY");
@@ -279,10 +261,8 @@ export function resolveApiKeySync(options) {
 /**
  * {@link resolveApiKeySync} as a Promise for call sites that already await.
  */
-export function resolveApiKey(options) {
-    return __awaiter(this, void 0, void 0, function* () {
-        return resolveApiKeySync(options);
-    });
+export async function resolveApiKey(options) {
+    return resolveApiKeySync(options);
 }
 /** One-line hint for "no credentials" errors, shared across surfaces. */
 export const SIGN_IN_HINT = `Run \`${CLI_COMMAND_NAME} login\` (or set CURSOR_API_KEY / CURSOR_API_KEY_FILE / CURSOR_SERVICE_ACCOUNT_KEY / pass serve({ apiKey })).`;
@@ -324,95 +304,100 @@ const POLL_PENDING_BODY = "Not found";
  * string, which is the exposure POST was added to remove, so it warns; it
  * disappears on its own once the backend serves POST.
  */
-export function pollForLoginTokens(args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        var _b, _c, _d;
-        const backendUrl = trimTrailingSlash((_b = args.backendUrl) !== null && _b !== void 0 ? _b : cursorBackendUrl());
-        const fetchImpl = (_c = args.fetchImpl) !== null && _c !== void 0 ? _c : fetch;
-        const redact = (text) => truncate(redactVerifier(text, args.verifier));
-        const postUrl = `${backendUrl}/auth/poll`;
-        // Only built if the backend leaves us no choice (see the doc comment).
-        const getUrl = () => {
-            const url = new URL("/auth/poll", `${backendUrl}/`);
-            url.searchParams.set("uuid", args.uuid);
-            url.searchParams.set("verifier", args.verifier);
-            return url.toString();
-        };
-        const maxAttempts = (_d = args.maxAttempts) !== null && _d !== void 0 ? _d : 150;
-        let useGet = false;
-        let consecutiveErrors = 0;
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            if (isAborted(args.signal)) {
-                return { status: "cancelled" };
-            }
-            try {
-                const response = useGet
-                    ? yield fetchImpl(getUrl(), Object.assign({ method: "GET", headers: { accept: "application/json" } }, (args.signal === undefined ? {} : { signal: args.signal })))
-                    : yield fetchImpl(postUrl, Object.assign({ method: "POST", headers: {
-                            accept: "application/json",
-                            "content-type": "application/json",
-                        }, body: JSON.stringify({ uuid: args.uuid, verifier: args.verifier }) }, (args.signal === undefined ? {} : { signal: args.signal })));
-                if (response.status === 404) {
-                    const body = (yield response.text()).trim();
-                    if (!useGet && body !== POLL_PENDING_BODY) {
-                        // Any 404 on POST that is not the pending marker means this backend
-                        // has no POST route. Retry the same attempt over GET rather than
-                        // guessing at body shapes; GET's handling below is deliberately
-                        // lenient, so an unrecognized body cannot strand the login.
-                        useGet = true;
-                        (_a = args.logger) === null || _a === void 0 ? void 0 : _a.call(args, `${backendUrl} has no POST /auth/poll; falling back to GET, which puts the single-use login verifier in the request URL (and the backend's access log). It will use POST once the backend deploys that route.`);
-                        continue;
-                    }
-                    if (useGet && isRouteNotFoundBody(body)) {
-                        // Neither verb is served — polling harder cannot fix that.
-                        return {
-                            status: "failed",
-                            message: `${backendUrl} serves neither POST nor GET /auth/poll (404: ${redact(body)})`,
-                        };
-                    }
-                    // Pending: the browser sign-in has not landed yet. On GET this is
-                    // deliberately lenient — treating an unrecognized 404 body as fatal is
-                    // what made an earlier poll die on its first attempt and call it a
-                    // timeout.
-                    consecutiveErrors = 0;
-                }
-                else if (!response.ok) {
-                    consecutiveErrors++;
-                    if (consecutiveErrors >= 3) {
-                        return {
-                            status: "failed",
-                            message: `${backendUrl}/auth/poll kept failing (${response.status}: ${redact((yield response.text()).trim())})`,
-                        };
-                    }
+export async function pollForLoginTokens(args) {
+    const backendUrl = trimTrailingSlash(args.backendUrl ?? cursorBackendUrl());
+    const fetchImpl = args.fetchImpl ?? fetch;
+    const redact = (text) => truncate(redactVerifier(text, args.verifier));
+    const postUrl = `${backendUrl}/auth/poll`;
+    // Only built if the backend leaves us no choice (see the doc comment).
+    const getUrl = () => {
+        const url = new URL("/auth/poll", `${backendUrl}/`);
+        url.searchParams.set("uuid", args.uuid);
+        url.searchParams.set("verifier", args.verifier);
+        return url.toString();
+    };
+    const maxAttempts = args.maxAttempts ?? 150;
+    let useGet = false;
+    let consecutiveErrors = 0;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        if (isAborted(args.signal)) {
+            return { status: "cancelled" };
+        }
+        try {
+            const response = useGet
+                ? await fetchImpl(getUrl(), {
+                    method: "GET",
+                    headers: { accept: "application/json" },
+                    ...(args.signal === undefined ? {} : { signal: args.signal }),
+                })
+                : await fetchImpl(postUrl, {
+                    method: "POST",
+                    headers: {
+                        accept: "application/json",
+                        "content-type": "application/json",
+                    },
+                    body: JSON.stringify({ uuid: args.uuid, verifier: args.verifier }),
+                    ...(args.signal === undefined ? {} : { signal: args.signal }),
+                });
+            if (response.status === 404) {
+                const body = (await response.text()).trim();
+                if (!useGet && body !== POLL_PENDING_BODY) {
+                    // Any 404 on POST that is not the pending marker means this backend
+                    // has no POST route. Retry the same attempt over GET rather than
+                    // guessing at body shapes; GET's handling below is deliberately
+                    // lenient, so an unrecognized body cannot strand the login.
+                    useGet = true;
+                    args.logger?.(`${backendUrl} has no POST /auth/poll; falling back to GET, which puts the single-use login verifier in the request URL (and the backend's access log). It will use POST once the backend deploys that route.`);
+                    continue;
                 }
-                else {
-                    const body = loginPollResponseSchema.safeParse(yield response.json());
-                    if (body.success && body.data.accessToken !== "") {
-                        return { status: "signed_in", accessToken: body.data.accessToken };
-                    }
+                if (useGet && isRouteNotFoundBody(body)) {
+                    // Neither verb is served — polling harder cannot fix that.
                     return {
                         status: "failed",
-                        message: `${backendUrl}/auth/poll returned 200 without an accessToken`,
+                        message: `${backendUrl} serves neither POST nor GET /auth/poll (404: ${redact(body)})`,
                     };
                 }
+                // Pending: the browser sign-in has not landed yet. On GET this is
+                // deliberately lenient — treating an unrecognized 404 body as fatal is
+                // what made an earlier poll die on its first attempt and call it a
+                // timeout.
+                consecutiveErrors = 0;
             }
-            catch (error) {
-                if (isAborted(args.signal)) {
-                    return { status: "cancelled" };
-                }
+            else if (!response.ok) {
                 consecutiveErrors++;
                 if (consecutiveErrors >= 3) {
                     return {
                         status: "failed",
-                        message: `could not reach ${backendUrl}/auth/poll (${redact(error instanceof Error ? error.message : String(error))})`,
+                        message: `${backendUrl}/auth/poll kept failing (${response.status}: ${redact((await response.text()).trim())})`,
                     };
                 }
             }
-            yield sleep(Math.min(1000 * Math.pow(1.2, attempt), 10000), args.signal);
+            else {
+                const body = loginPollResponseSchema.safeParse(await response.json());
+                if (body.success && body.data.accessToken !== "") {
+                    return { status: "signed_in", accessToken: body.data.accessToken };
+                }
+                return {
+                    status: "failed",
+                    message: `${backendUrl}/auth/poll returned 200 without an accessToken`,
+                };
+            }
         }
-        return { status: "timed_out" };
-    });
+        catch (error) {
+            if (isAborted(args.signal)) {
+                return { status: "cancelled" };
+            }
+            consecutiveErrors++;
+            if (consecutiveErrors >= 3) {
+                return {
+                    status: "failed",
+                    message: `could not reach ${backendUrl}/auth/poll (${redact(error instanceof Error ? error.message : String(error))})`,
+                };
+            }
+        }
+        await sleep(Math.min(1000 * 1.2 ** attempt, 10_000), args.signal);
+    }
+    return { status: "timed_out" };
 }
 /**
  * Fastify's route-not-found envelope: `{"message":"Route GET:/auth/poll not
@@ -429,7 +414,7 @@ function isRouteNotFoundBody(body) {
             /^Route \w+:/.test(parsed.message) &&
             parsed.message.includes("not found"));
     }
-    catch (_a) {
+    catch {
         return false;
     }
 }
@@ -457,22 +442,22 @@ function truncate(value, max = 200) {
 // `await` aren't collapsed by control-flow narrowing (the signal is mutated
 // by another task, so `aborted` really can flip mid-loop).
 function isAborted(signal) {
-    return (signal === null || signal === void 0 ? void 0 : signal.aborted) === true;
+    return signal?.aborted === true;
 }
 function sleep(ms, signal) {
     return new Promise(resolve => {
-        if ((signal === null || signal === void 0 ? void 0 : signal.aborted) === true) {
+        if (signal?.aborted === true) {
             resolve();
             return;
         }
         const timer = setTimeout(() => {
-            signal === null || signal === void 0 ? void 0 : signal.removeEventListener("abort", onAbort);
+            signal?.removeEventListener("abort", onAbort);
             resolve();
         }, ms);
         const onAbort = () => {
             clearTimeout(timer);
             resolve();
         };
-        signal === null || signal === void 0 ? void 0 : signal.addEventListener("abort", onAbort, { once: true });
+        signal?.addEventListener("abort", onAbort, { once: true });
     });
 }

package/dist/internal/cursor/cursor-api-transport.js

@@ -15,8 +15,7 @@ function trimTrailingSlash(raw) {
     return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
 }
 export function resolveCursorApiBaseUrl(options) {
-    var _a, _b;
-    return trimTrailingSlash((_b = (_a = options.baseUrl) !== null && _a !== void 0 ? _a : process.env.CURSOR_API_BASE_URL) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_EXTERNAL_API_URL);
+    return trimTrailingSlash(options.baseUrl ?? process.env.CURSOR_API_BASE_URL ?? DEFAULT_CURSOR_EXTERNAL_API_URL);
 }
 /**
  * The pod credential is the whole authorization on every hosted wire: the
@@ -25,18 +24,15 @@ export function resolveCursorApiBaseUrl(options) {
  * calling the control plane as nobody is worse than not calling.
  */
 export function resolveCursorApiKey(options) {
-    var _a, _b;
-    var _c;
-    const configured = (_c = (_a = options.resolveApiKey) === null || _a === void 0 ? void 0 : _a.call(options)) !== null && _c !== void 0 ? _c : options.apiKey;
-    const key = (_b = (configured !== null && configured !== void 0 ? configured : process.env.CURSOR_API_KEY)) === null || _b === void 0 ? void 0 : _b.trim();
+    const configured = options.resolveApiKey?.() ?? options.apiKey;
+    const key = (configured ?? process.env.CURSOR_API_KEY)?.trim();
     if (key === undefined || key === "") {
         throw new Error("Cursor hosted transport requires CURSOR_API_KEY (deployment pod credential on Cursor hosting)");
     }
     return key;
 }
 export function resolveCursorApiFetch(options) {
-    var _a;
-    const impl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+    const impl = options.fetch ?? globalThis.fetch;
     if (typeof impl !== "function") {
         throw new Error("Cursor hosted transport requires fetch");
     }