@cursor/bdk 0.2.9 → 0.2.11

package/dist/channels/bitbucket/bitbucket-webhook.js

@@ -1,32 +1,32 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
 import { continuationSource } from "../../internal/continuation-identity.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
+import { resolveWebhookSecretValue } from "../../internal/named-webhook-secret.js";
 import { asNonEmptyString, asPositiveInt, asRecord, bitbucketCommentFromPayload, bitbucketPullRequestFromPayload, bitbucketPullRequestRecord, bitbucketPullRequestUrl, bitbucketPushFromPayload, bitbucketRepositoryFromPayload, bitbucketUser, buildBitbucketBinding, } from "./binding.js";
 import { defaultBitbucketPullRequestDispatch, defaultBitbucketPullRequestMessage, defaultBitbucketTitle, } from "./defaults.js";
 import { BITBUCKET_CHANNEL_KIND, BITBUCKET_PULL_REQUEST_EVENTS, normalizeBitbucketEventKey, } from "./events.js";
 import { bitbucketChannelStateForEvent } from "./state.js";
+/** Env var / deployment secret an omitted `webhookSecret` falls back to. */
+export const BITBUCKET_WEBHOOK_SECRET_ENV = "BITBUCKET_WEBHOOK_SECRET";
+/** Header both dialects sign deliveries with; `sha256=<hex hmac of the raw body>`. */
+export const BITBUCKET_SIGNATURE_HEADER = "x-hub-signature";
+export const BITBUCKET_SIGNATURE_PREFIX = "sha256=";
 /** `BITBUCKET_WEBHOOK_SECRET` fallback for {@link BitbucketChannelOptions.webhookSecret}. */
 export function envBitbucketWebhookSecret() {
-    var _a;
-    const value = (_a = process.env.BITBUCKET_WEBHOOK_SECRET) === null || _a === void 0 ? void 0 : _a.trim();
+    const value = process.env[BITBUCKET_WEBHOOK_SECRET_ENV]?.trim();
     return value === undefined || value === "" ? undefined : value;
 }
+/**
+ * The secret's value for the handler's own signature check. A named secret
+ * resolves from the environment (locally the shell's, hosted the bound
+ * deployment secrets); an unset field falls back to
+ * `BITBUCKET_WEBHOOK_SECRET`.
+ */
 export function resolveBitbucketWebhookSecret(options) {
-    const authored = typeof options.webhookSecret === "function" ? options.webhookSecret() : options.webhookSecret;
-    const trimmed = authored === null || authored === void 0 ? void 0 : authored.trim();
-    return trimmed === undefined || trimmed === "" ? envBitbucketWebhookSecret() : trimmed;
+    return resolveWebhookSecretValue(options.webhookSecret) ?? envBitbucketWebhookSecret();
 }
-const SIGNATURE_PREFIX = "sha256=";
+const SIGNATURE_PREFIX = BITBUCKET_SIGNATURE_PREFIX;
 /** The `X-Hub-Signature` value Bitbucket sends for a raw body. */
 export function signBitbucketWebhookBody(rawBody, secret) {
     return `${SIGNATURE_PREFIX}${createHmac("sha256", secret).update(rawBody).digest("hex")}`;
@@ -69,13 +69,13 @@ export function parseBitbucketWebhookPayload(payload, eventKey) {
         return null;
     }
     const fromBody = asNonEmptyString(record.eventKey);
-    const fromHeader = (eventKey === null || eventKey === void 0 ? void 0 : eventKey.trim()) || undefined;
+    const fromHeader = eventKey?.trim() || undefined;
     if (fromBody !== undefined &&
         fromHeader !== undefined &&
         normalizeBitbucketEventKey(fromBody) !== normalizeBitbucketEventKey(fromHeader)) {
         return null;
     }
-    const raw = fromBody !== null && fromBody !== void 0 ? fromBody : fromHeader;
+    const raw = fromBody ?? fromHeader;
     if (raw === undefined) {
         return null;
     }
@@ -145,91 +145,98 @@ function isPullRequestEvent(eventType) {
     return BITBUCKET_PULL_REQUEST_EVENTS.includes(eventType);
 }
 export function parseBitbucketEventContext(delivery) {
-    var _a, _b;
-    var _c;
     const repository = bitbucketRepositoryFromPayload(delivery.payload);
     if (repository === undefined) {
         return null;
     }
     const pullRequestRecord = bitbucketPullRequestRecord(delivery.payload);
-    const pullRequestId = asPositiveInt(pullRequestRecord === null || pullRequestRecord === void 0 ? void 0 : pullRequestRecord.id);
-    return Object.assign(Object.assign({ deliveryId: delivery.deliveryId, eventType: delivery.eventType, rawEventType: (_c = delivery.rawEventType) !== null && _c !== void 0 ? _c : delivery.eventType, repository }, (pullRequestId === undefined
-        ? {}
-        : {
-            pullRequestId,
-            pullRequestUrl: bitbucketPullRequestUrl(repository, pullRequestId, asNonEmptyString((_b = asRecord((_a = asRecord(pullRequestRecord === null || pullRequestRecord === void 0 ? void 0 : pullRequestRecord.links)) === null || _a === void 0 ? void 0 : _a.html)) === null || _b === void 0 ? void 0 : _b.href)),
-        })), { payload: delivery.payload, sender: bitbucketUser(delivery.payload.actor) });
+    const pullRequestId = asPositiveInt(pullRequestRecord?.id);
+    return {
+        deliveryId: delivery.deliveryId,
+        eventType: delivery.eventType,
+        rawEventType: delivery.rawEventType ?? delivery.eventType,
+        repository,
+        ...(pullRequestId === undefined
+            ? {}
+            : {
+                pullRequestId,
+                pullRequestUrl: bitbucketPullRequestUrl(repository, pullRequestId, asNonEmptyString(asRecord(asRecord(pullRequestRecord?.links)?.html)?.href)),
+            }),
+        payload: delivery.payload,
+        sender: bitbucketUser(delivery.payload.actor),
+    };
 }
 function invalidPayload(error) {
     return Response.json({ ok: false, error }, { status: 400 });
 }
-function startTurn(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const source = continuationSource(input.options.continuation, "bitbucket");
-        const session = yield input.args.send(input.message, Object.assign(Object.assign(Object.assign(Object.assign({ auth: input.dispatch.auth }, (source === "engine" && input.ctx.pullRequestId !== undefined
+async function startTurn(input) {
+    const source = continuationSource(input.options.continuation, "bitbucket");
+    const session = await input.args.send(input.message, {
+        auth: input.dispatch.auth,
+        // v1 agents (omitted continuation resolves to `none/v1`) keep one
+        // engine-minted conversation per pull request; v2 takes the CP stamp.
+        ...(source === "engine" && input.ctx.pullRequestId !== undefined
             ? {
                 continuationToken: `bitbucket-pr:${input.ctx.repository.fullName.toLowerCase()}#${input.ctx.pullRequestId}`,
             }
-            : {})), { title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultBitbucketTitle(input.ctx) }), (input.cloud === undefined ? {} : { cloud: input.cloud })), { state: input.state, refreshState: input.state }));
-        return turnStarted(session);
+            : {}),
+        title: input.dispatch.title ?? defaultBitbucketTitle(input.ctx),
+        ...(input.cloud === undefined ? {} : { cloud: input.cloud }),
+        state: input.state,
+        refreshState: input.state,
     });
+    return turnStarted(session);
 }
-function resolveCloudOptions(cloud, ctx, pullRequest) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        if (cloud === undefined || cloud === false) {
-            return undefined;
-        }
-        if (cloud === true) {
-            const url = (_a = ctx.repository.htmlUrl) !== null && _a !== void 0 ? _a : (ctx.repository.dialect === "cloud"
+async function resolveCloudOptions(cloud, ctx, pullRequest) {
+    if (cloud === undefined || cloud === false) {
+        return undefined;
+    }
+    if (cloud === true) {
+        const url = ctx.repository.htmlUrl ??
+            (ctx.repository.dialect === "cloud"
                 ? `https://bitbucket.org/${ctx.repository.fullName}`
                 : undefined);
-            if (url === undefined) {
-                return undefined;
-            }
-            return {
-                repos: [
-                    {
-                        url,
-                        prUrl: pullRequest.htmlUrl,
-                        startingRef: pullRequest.headSha,
-                    },
-                ],
-            };
-        }
-        if (typeof cloud === "function") {
-            return yield cloud(ctx, pullRequest);
+        if (url === undefined) {
+            return undefined;
         }
-        return cloud;
-    });
+        return {
+            repos: [
+                {
+                    url,
+                    prUrl: pullRequest.htmlUrl,
+                    startingRef: pullRequest.headSha,
+                },
+            ],
+        };
+    }
+    if (typeof cloud === "function") {
+        return await cloud(ctx, pullRequest);
+    }
+    return cloud;
 }
-function applyDispatch(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        if (input.dispatch === null) {
-            return skipped("not_dispatched", input.extra);
-        }
-        if (isTaskDispatch(input.dispatch)) {
-            return acknowledgeTask(input.args, BITBUCKET_CHANNEL_KIND, input.dispatch, input.extra);
-        }
-        const message = [(_a = input.dispatch.message) !== null && _a !== void 0 ? _a : input.message, ...((_b = input.dispatch.context) !== null && _b !== void 0 ? _b : [])].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx: input.ctx,
-            message,
-            dispatch: input.dispatch,
-            cloud: input.cloud,
-            state: bitbucketChannelStateForEvent({
-                repository: input.ctx.repository,
-                pullRequestId: input.ctx.pullRequestId,
-                headSha: input.headSha,
-                deliveryId: input.ctx.deliveryId,
-                eventType: input.ctx.eventType,
-                triggeringCommentId: input.triggeringCommentId,
-            }),
-        });
+async function applyDispatch(input) {
+    if (input.dispatch === null) {
+        return skipped("not_dispatched", input.extra);
+    }
+    if (isTaskDispatch(input.dispatch)) {
+        return acknowledgeTask(input.args, BITBUCKET_CHANNEL_KIND, input.dispatch, input.extra);
+    }
+    const message = [input.dispatch.message ?? input.message, ...(input.dispatch.context ?? [])].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx: input.ctx,
+        message,
+        dispatch: input.dispatch,
+        cloud: input.cloud,
+        state: bitbucketChannelStateForEvent({
+            repository: input.ctx.repository,
+            pullRequestId: input.ctx.pullRequestId,
+            headSha: input.headSha,
+            deliveryId: input.ctx.deliveryId,
+            eventType: input.ctx.eventType,
+            triggeringCommentId: input.triggeringCommentId,
+        }),
     });
 }
 /**
@@ -238,108 +245,111 @@ function applyDispatch(input) {
  * hosted admission arrives verified. The v2 mailbox is stamped upstream
  * (local CP or hosted ingress), never here.
  */
-export function dispatchBitbucketWebhook(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { eventType, payload } = input.delivery;
-        const parsed = parseBitbucketEventContext(input.delivery);
-        if (parsed === null) {
-            return invalidPayload("invalid_bitbucket_payload");
-        }
-        const args = input.args;
-        const ctx = Object.assign(Object.assign({}, parsed), { bitbucket: buildBitbucketBinding({
-                repository: parsed.repository,
-                proxy: (_a = input.proxy) === null || _a === void 0 ? void 0 : _a.call(input),
-                token: input.options.token,
-                apiBaseUrl: input.options.apiBaseUrl,
-            }), host: args.host, artifacts: args.artifacts, send: args.send });
-        const allowlist = configuredRepoAllowlist(input.options);
-        if (allowlist !== undefined && !allowlist.has(ctx.repository.fullName.toLowerCase())) {
-            return skipped("repo_not_allowed", { repo: ctx.repository.fullName });
+export async function dispatchBitbucketWebhook(input) {
+    const { eventType, payload } = input.delivery;
+    const parsed = parseBitbucketEventContext(input.delivery);
+    if (parsed === null) {
+        return invalidPayload("invalid_bitbucket_payload");
+    }
+    const args = input.args;
+    const ctx = {
+        ...parsed,
+        bitbucket: buildBitbucketBinding({
+            repository: parsed.repository,
+            proxy: input.proxy?.(),
+            token: input.options.token,
+            apiBaseUrl: input.options.apiBaseUrl,
+        }),
+        host: args.host,
+        artifacts: args.artifacts,
+        send: args.send,
+    };
+    const allowlist = configuredRepoAllowlist(input.options);
+    if (allowlist !== undefined && !allowlist.has(ctx.repository.fullName.toLowerCase())) {
+        return skipped("repo_not_allowed", { repo: ctx.repository.fullName });
+    }
+    const extra = { event: eventType, rawEvent: ctx.rawEventType };
+    if (isPullRequestEvent(eventType)) {
+        const action = eventType.slice("pullrequest:".length);
+        const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, action);
+        if (pullRequest === undefined) {
+            return invalidPayload("invalid_bitbucket_pull_request_payload");
         }
-        const extra = { event: eventType, rawEvent: ctx.rawEventType };
-        if (isPullRequestEvent(eventType)) {
-            const action = eventType.slice("pullrequest:".length);
-            const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, action);
-            if (pullRequest === undefined) {
-                return invalidPayload("invalid_bitbucket_pull_request_payload");
+        const dispatch = input.options.onPullRequest === undefined
+            ? defaultBitbucketPullRequestDispatch(ctx, pullRequest)
+            : await input.options.onPullRequest(ctx, pullRequest);
+        return applyDispatch({
+            options: input.options,
+            args,
+            ctx,
+            dispatch,
+            extra: { ...extra, action },
+            message: defaultBitbucketPullRequestMessage(ctx, pullRequest),
+            cloud: await resolveCloudOptions(input.options.cloud, ctx, pullRequest),
+            headSha: pullRequest.headSha,
+        });
+    }
+    switch (eventType) {
+        case "pullrequest:comment_created": {
+            if (input.options.onPullRequestComment === undefined) {
+                return skipped("no_handler", extra);
             }
-            const dispatch = input.options.onPullRequest === undefined
-                ? defaultBitbucketPullRequestDispatch(ctx, pullRequest)
-                : yield input.options.onPullRequest(ctx, pullRequest);
+            const comment = bitbucketCommentFromPayload(payload);
+            const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, "comment_created");
+            if (comment === undefined || pullRequest === undefined) {
+                return invalidPayload("invalid_bitbucket_comment_payload");
+            }
+            const dispatch = await input.options.onPullRequestComment(ctx, comment, pullRequest);
             return applyDispatch({
                 options: input.options,
                 args,
                 ctx,
                 dispatch,
-                extra: Object.assign(Object.assign({}, extra), { action }),
-                message: defaultBitbucketPullRequestMessage(ctx, pullRequest),
-                cloud: yield resolveCloudOptions(input.options.cloud, ctx, pullRequest),
+                extra,
+                message: `Bitbucket comment on ${ctx.repository.fullName}#${pullRequest.id}`,
                 headSha: pullRequest.headSha,
+                triggeringCommentId: comment.id,
             });
         }
-        switch (eventType) {
-            case "pullrequest:comment_created": {
-                if (input.options.onPullRequestComment === undefined) {
-                    return skipped("no_handler", extra);
-                }
-                const comment = bitbucketCommentFromPayload(payload);
-                const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, "comment_created");
-                if (comment === undefined || pullRequest === undefined) {
-                    return invalidPayload("invalid_bitbucket_comment_payload");
-                }
-                const dispatch = yield input.options.onPullRequestComment(ctx, comment, pullRequest);
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: `Bitbucket comment on ${ctx.repository.fullName}#${pullRequest.id}`,
-                    headSha: pullRequest.headSha,
-                    triggeringCommentId: comment.id,
-                });
+        case "repo:push": {
+            if (input.options.onPush === undefined) {
+                return skipped("no_handler", extra);
             }
-            case "repo:push": {
-                if (input.options.onPush === undefined) {
-                    return skipped("no_handler", extra);
-                }
-                const push = bitbucketPushFromPayload(payload);
-                if (push === undefined) {
-                    return invalidPayload("invalid_bitbucket_push_payload");
-                }
-                const dispatch = yield input.options.onPush(ctx, push);
-                const first = push.changes[0];
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: `Bitbucket push to ${ctx.repository.fullName}${(first === null || first === void 0 ? void 0 : first.name) === undefined ? "" : ` ${first.name}`}`,
-                    headSha: first === null || first === void 0 ? void 0 : first.after,
-                });
+            const push = bitbucketPushFromPayload(payload);
+            if (push === undefined) {
+                return invalidPayload("invalid_bitbucket_push_payload");
             }
-            default: {
-                if (input.options.onEvent === undefined) {
-                    return skipped("unsupported_event", extra);
-                }
-                const dispatch = yield input.options.onEvent(ctx, {
-                    eventType,
-                    rawEventType: ctx.rawEventType,
-                    payload,
-                });
-                return applyDispatch({
-                    options: input.options,
-                    args,
-                    ctx,
-                    dispatch,
-                    extra,
-                    message: `Bitbucket ${eventType} event on ${ctx.repository.fullName}`,
-                });
+            const dispatch = await input.options.onPush(ctx, push);
+            const first = push.changes[0];
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra,
+                message: `Bitbucket push to ${ctx.repository.fullName}${first?.name === undefined ? "" : ` ${first.name}`}`,
+                headSha: first?.after,
+            });
+        }
+        default: {
+            if (input.options.onEvent === undefined) {
+                return skipped("unsupported_event", extra);
             }
+            const dispatch = await input.options.onEvent(ctx, {
+                eventType,
+                rawEventType: ctx.rawEventType,
+                payload,
+            });
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra,
+                message: `Bitbucket ${eventType} event on ${ctx.repository.fullName}`,
+            });
         }
-    });
+    }
 }
 /**
  * HTTP entry for a single agent's Bitbucket channel: `X-Hub-Signature` HMAC
@@ -347,38 +357,38 @@ export function dispatchBitbucketWebhook(input) {
  * Without a secret the route auth owns admission (`serve --dev` admits
  * loopback only; production stays loopback-strict).
  */
-export function handleBitbucketWebhookRequest(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        const bodyText = yield input.request.text();
-        const secret = resolveBitbucketWebhookSecret(input.options);
-        if (secret !== undefined && input.skipSignatureVerification !== true) {
-            if (!verifyBitbucketWebhookSignature(bodyText, input.request.headers.get("x-hub-signature"), secret)) {
-                return Response.json({ ok: false, error: "invalid_signature" }, { status: 401 });
-            }
-        }
-        let payload;
-        try {
-            payload = JSON.parse(bodyText);
-        }
-        catch (_c) {
-            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
-        }
-        const delivery = parseBitbucketWebhookPayload(payload, input.request.headers.get("x-event-key"));
-        if (delivery === null) {
-            return invalidPayload("invalid_bitbucket_payload");
+export async function handleBitbucketWebhookRequest(input) {
+    const bodyText = await input.request.text();
+    const secret = resolveBitbucketWebhookSecret(input.options);
+    if (secret !== undefined && input.skipSignatureVerification !== true) {
+        if (!verifyBitbucketWebhookSignature(bodyText, input.request.headers.get(BITBUCKET_SIGNATURE_HEADER), secret)) {
+            return Response.json({ ok: false, error: "invalid_signature" }, { status: 401 });
         }
-        delivery.deliveryId = (_b = (_a = input.request.headers.get("x-request-uuid")) !== null && _a !== void 0 ? _a : input.request.headers.get("x-request-id")) !== null && _b !== void 0 ? _b : undefined;
-        return dispatchBitbucketWebhook({
-            options: input.options,
-            delivery,
-            proxy: input.proxy,
-            args: bindLocalIngressSend(input.args, {
-                identity: input.options.continuation,
-                kind: BITBUCKET_CHANNEL_KIND,
-                eventType: delivery.eventType,
-                payload: delivery.payload,
-            }),
-        });
+    }
+    let payload;
+    try {
+        payload = JSON.parse(bodyText);
+    }
+    catch {
+        return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+    }
+    const delivery = parseBitbucketWebhookPayload(payload, input.request.headers.get("x-event-key"));
+    if (delivery === null) {
+        return invalidPayload("invalid_bitbucket_payload");
+    }
+    delivery.deliveryId =
+        input.request.headers.get("x-request-uuid") ??
+            input.request.headers.get("x-request-id") ??
+            undefined;
+    return dispatchBitbucketWebhook({
+        options: input.options,
+        delivery,
+        proxy: input.proxy,
+        args: bindLocalIngressSend(input.args, {
+            identity: input.options.continuation,
+            kind: BITBUCKET_CHANNEL_KIND,
+            eventType: delivery.eventType,
+            payload: delivery.payload,
+        }),
     });
 }

package/dist/channels/bitbucket/checks.js

@@ -9,15 +9,6 @@
  * Bitbucket's state set and re-posts the full desired state on every write,
  * so `resumeBitbucketCheck` needs only `(sha, key)` to rebuild a handle.
  */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { openCiCheck, resumeCiCheck, } from "../checks.js";
 /** Shared check status / conclusion → Bitbucket build-status state. */
 export function bitbucketBuildStatusState(input) {
@@ -44,28 +35,25 @@ export function bitbucketBuildStatusState(input) {
  * Build statuses have no server id or page URL of their own.
  */
 function bitbucketCheckWriter(input) {
-    var _a;
-    let lastStatus = (_a = input.status) !== null && _a !== void 0 ? _a : "in_progress";
+    let lastStatus = input.status ?? "in_progress";
     let lastUrl = input.url;
-    return (write) => __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        var _c, _d, _e;
-        const status = (_c = write.status) !== null && _c !== void 0 ? _c : (write.conclusion === undefined ? lastStatus : "completed");
+    return async (write) => {
+        const status = write.status ?? (write.conclusion === undefined ? lastStatus : "completed");
         lastStatus = status;
-        lastUrl = (_d = write.detailsUrl) !== null && _d !== void 0 ? _d : lastUrl;
-        yield input.bitbucket.setBuildStatus({
+        lastUrl = write.detailsUrl ?? lastUrl;
+        await input.bitbucket.setBuildStatus({
             sha: input.sha,
             key: input.name,
-            name: (_e = (_a = write.output) === null || _a === void 0 ? void 0 : _a.title) !== null && _e !== void 0 ? _e : input.name,
+            name: write.output?.title ?? input.name,
             state: bitbucketBuildStatusState({
                 status,
                 conclusion: write.conclusion,
             }),
             url: lastUrl,
-            description: (_b = write.output) === null || _b === void 0 ? void 0 : _b.summary,
+            description: write.output?.summary,
         });
         return lastUrl === undefined ? undefined : { url: lastUrl };
-    });
+    };
 }
 /**
  * Open a build status on `sha` and return a handle for later updates.
@@ -97,6 +85,6 @@ export function resumeBitbucketCheck(input) {
  */
 export function bindBitbucketChecks(input) {
     return {
-        createCheck: check => createBitbucketCheck(Object.assign(Object.assign({}, check), { bitbucket: input.bitbucket })),
+        createCheck: check => createBitbucketCheck({ ...check, bitbucket: input.bitbucket }),
     };
 }

package/dist/channels/bitbucket/cursor-account.js

@@ -49,7 +49,7 @@ export function createPendingCursorBitbucketCredentials() {
             if (getApiKey === undefined || transport === undefined) {
                 return undefined;
             }
-            return Object.assign(Object.assign({}, transport), { getApiKey });
+            return { ...transport, getApiKey };
         },
     };
 }

package/dist/channels/bitbucket/defaults.js

@@ -8,7 +8,7 @@ function issuerHost(ctx) {
         try {
             return new URL(ctx.repository.htmlUrl).host;
         }
-        catch (_a) {
+        catch {
             // fall through to the dialect default
         }
     }
@@ -26,9 +26,19 @@ export function defaultBitbucketAuth(ctx) {
         authenticator: "bitbucket-webhook",
         principalId: sender === undefined ? "bitbucket" : sender.id,
         principalType: "user",
-        attributes: Object.assign(Object.assign(Object.assign({ conversation_kind: ctx.pullRequestId === undefined ? ctx.eventType : "pull_request", repo: ctx.repository.fullName, dialect: ctx.repository.dialect }, (ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId })), (sender === undefined
-            ? {}
-            : Object.assign({ subject: sender.id }, (sender.username === undefined ? {} : { username: sender.username })))), { issuer: `bitbucket:${issuerHost(ctx)}` }),
+        attributes: {
+            conversation_kind: ctx.pullRequestId === undefined ? ctx.eventType : "pull_request",
+            repo: ctx.repository.fullName,
+            dialect: ctx.repository.dialect,
+            ...(ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId }),
+            ...(sender === undefined
+                ? {}
+                : {
+                    subject: sender.id,
+                    ...(sender.username === undefined ? {} : { username: sender.username }),
+                }),
+            issuer: `bitbucket:${issuerHost(ctx)}`,
+        },
     };
 }
 export function defaultBitbucketTitle(ctx) {

package/dist/channels/bitbucket/events.js

@@ -18,9 +18,8 @@ export const BITBUCKET_DATA_CENTER_EVENT_KEYS = {
 };
 /** `pr:opened` → `pullrequest:created`; Cloud keys pass through unchanged. */
 export function normalizeBitbucketEventKey(eventKey) {
-    var _a;
     const trimmed = eventKey.trim();
-    return (_a = BITBUCKET_DATA_CENTER_EVENT_KEYS[trimmed]) !== null && _a !== void 0 ? _a : trimmed;
+    return BITBUCKET_DATA_CENTER_EVENT_KEYS[trimmed] ?? trimmed;
 }
 /** Cloud pull-request event keys, grouped by the hook that receives them. */
 export const BITBUCKET_PULL_REQUEST_EVENTS = [

package/dist/channels/bitbucket/index.d.ts

@@ -5,7 +5,9 @@
  * import { bitbucketChannel, defaultBitbucketAuth } from "@cursor/bdk/channels/bitbucket";
  *
  * export default bitbucketChannel({
- *   webhookSecret: () => process.env.BITBUCKET_WEBHOOK_SECRET,
+ *   // Named, not read: locally `process.env.BITBUCKET_WEBHOOK_SECRET`; hosted,
+ *   // the deployment secret, which the control plane checks at ingestion.
+ *   webhookSecret: { secretName: "BITBUCKET_WEBHOOK_SECRET" },
  *   onPullRequest: (ctx) => ({ auth: defaultBitbucketAuth(ctx) }),
  *   onPullRequestComment: (ctx) => ({ auth: defaultBitbucketAuth(ctx) }),
  * });
@@ -17,7 +19,9 @@
  * are normalized to the Cloud vocabulary (`pullrequest:created`) before
  * hooks run, and payload fields from either dialect land on one shape.
  * Hosted deployments receive deliveries the Cursor backend already verified
- * and normalized. The turn principal is `bitbucket-webhook` plus the
+ * and normalized: a named `webhookSecret` lets the control plane verify
+ * `X-Hub-Signature` before any compute starts (architecture `v2` requires
+ * that form) and the handler verifies it again on replay. The turn principal is `bitbucket-webhook` plus the
  * Bitbucket actor — not the Cursor subscriber.
  */
 export * from "./api.js";

package/dist/channels/bitbucket/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,KAAK,eAAe,EACpB,+BAA+B,EAC/B,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,KAAK,wBAAwB,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,KAAK,eAAe,EACpB,+BAA+B,EAC/B,2BAA2B,EAC3B,kBAAkB,EAClB,yBAAyB,EACzB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,KAAK,wBAAwB,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC"}