@cursor/july 0.1.100 → 0.1.102

package/dist/internal/cursor/backend-client.js

@@ -2,7 +2,8 @@
  * Minimal Connect-JSON client for the handful of `aiserver.v1.DashboardService`
  * RPCs agent-serve needs — `GetMe`, `ListSandMcpTools`, `ExecuteSandMcpTool`,
  * and the login-time key lifecycle (`CreateUserApiKey`, `ListUserApiKeys`,
- * `RevokeUserApiKey`).
+ * `RevokeUserApiKey`) — plus {@link CursorBackendClient.serviceRpc} for the
+ * odd unary call on another `aiserver.v1` service under the same token.
  *
  * Plain `fetch` POSTs with proto-JSON bodies and zod-validated responses:
  * agent-serve is a published package and should not pull the generated
@@ -26,7 +27,7 @@ import { z } from "zod";
 import { boundedToolAnnotations } from "../mcp-host.js";
 import { CURSOR_SESSION_EXCHANGE_PATH, CursorSessionExchangeError, exchangeCursorApiKeyForSession, SESSION_TOKEN_EXPIRY_LEEWAY_MS, } from "./session-token.js";
 const CLIENT_VERSION = "agent-serve-0.1.0";
-const SERVICE_PREFIX = "/aiserver.v1.DashboardService";
+const DASHBOARD_SERVICE = "DashboardService";
 const LIST_TIMEOUT_MS = 60000;
 /** Backend-executed tools call out to third-party servers; be generous. */
 const EXECUTE_TIMEOUT_MS = 120000;
@@ -144,11 +145,11 @@ const executeResponseSchema = z.object({
 // Shared request machinery (used by the client and the login-time mint)
 // ============================================================================
 /** One DashboardService Connect-JSON POST; auth is the caller's bearer. */
-function dashboardRpc(args) {
+function connectRpc(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         try {
-            return yield args.fetchImpl(`${args.backendUrl}${SERVICE_PREFIX}/${args.method}`, {
+            return yield args.fetchImpl(`${args.backendUrl}/aiserver.v1.${args.service}/${args.method}`, {
                 method: "POST",
                 headers: Object.assign({ "content-type": "application/json", authorization: `Bearer ${args.bearer}`, "x-ghost-mode": "true", "x-cursor-client-version": CLIENT_VERSION, "x-cursor-client-type": "agent-serve", "x-request-id": randomUUID() }, args.extraHeaders),
                 body: JSON.stringify((_a = args.body) !== null && _a !== void 0 ? _a : {}),
@@ -313,16 +314,27 @@ export class CursorBackendClient {
             return githubTokenResponseSchema.parse(parsed);
         });
     }
+    /**
+     * One unary Connect-JSON call on `aiserver.v1.<service>` with the same
+     * token exchange and 401 retry as the dashboard RPCs. Callers parse the
+     * proto-JSON response themselves.
+     */
+    serviceRpc(service, method, body, timeoutMs = LIST_TIMEOUT_MS) {
+        return this.rpc(method, body, timeoutMs, { service });
+    }
     rpc(method_1, body_1) {
         return __awaiter(this, arguments, void 0, function* (method, body, timeoutMs = LIST_TIMEOUT_MS, options) {
             var _a, _b;
+            var _c;
+            const service = (_c = options === null || options === void 0 ? void 0 : options.service) !== null && _c !== void 0 ? _c : DASHBOARD_SERVICE;
             const extraHeaders = (options === null || options === void 0 ? void 0 : options.teamId) === undefined
                 ? undefined
                 : { "x-cursor-team-id": String(options.teamId) };
             const bearer = yield this.getAccessToken();
-            const first = yield dashboardRpc({
+            const first = yield connectRpc({
                 fetchImpl: this.fetchImpl,
                 backendUrl: this.backendUrl,
+                service,
                 method,
                 bearer,
                 body,
@@ -340,9 +352,10 @@ export class CursorBackendClient {
                 this.token = undefined;
             }
             const retryBearer = yield this.getAccessToken();
-            const second = yield dashboardRpc({
+            const second = yield connectRpc({
                 fetchImpl: this.fetchImpl,
                 backendUrl: this.backendUrl,
+                service,
                 method,
                 bearer: retryBearer,
                 body,
@@ -421,11 +434,12 @@ export class CursorBackendClient {
 export function createUserApiKeyWithSessionToken(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
-        const response = yield dashboardRpc({
+        const response = yield connectRpc({
             fetchImpl: (_a = args.fetchImpl) !== null && _a !== void 0 ? _a : fetch,
             backendUrl: args.backendUrl.endsWith("/")
                 ? args.backendUrl.slice(0, -1)
                 : args.backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "CreateUserApiKey",
             bearer: args.sessionToken,
             body: { name: args.keyName },
@@ -463,9 +477,10 @@ export function revokeMintedUserApiKey(args) {
         const backendUrl = args.backendUrl.endsWith("/")
             ? args.backendUrl.slice(0, -1)
             : args.backendUrl;
-        const listResponse = yield dashboardRpc({
+        const listResponse = yield connectRpc({
             fetchImpl,
             backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "ListUserApiKeys",
             bearer: args.sessionToken,
             body: {},
@@ -479,9 +494,10 @@ export function revokeMintedUserApiKey(args) {
             // lagging replica — skip rather than touch any other key.
             return;
         }
-        const revokeResponse = yield dashboardRpc({
+        const revokeResponse = yield connectRpc({
             fetchImpl,
             backendUrl,
+            service: DASHBOARD_SERVICE,
             method: "RevokeUserApiKey",
             bearer: args.sessionToken,
             body: { id: match.id },

package/dist/internal/cursor/hosted-deployment-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+export declare const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export declare function refreshBoundDeploymentSecrets(path?: string): void;
+//# sourceMappingURL=hosted-deployment-secrets.d.ts.map

package/dist/internal/cursor/hosted-deployment-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAqC5D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,IAAI,CAeN"}

package/dist/internal/cursor/hosted-deployment-secrets.js

@@ -0,0 +1,61 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+import { readFileSync } from "node:fs";
+export const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+const appliedSecretNames = new Set();
+function parseBoundSecrets(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (_a) {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return undefined;
+    }
+    const envelope = parsed;
+    if (envelope.v !== 1 ||
+        envelope.secrets === null ||
+        typeof envelope.secrets !== "object" ||
+        Array.isArray(envelope.secrets)) {
+        return undefined;
+    }
+    const secrets = {};
+    for (const [name, value] of Object.entries(envelope.secrets)) {
+        if (SECRET_NAME_PATTERN.test(name) &&
+            !name.startsWith("CURSOR_") &&
+            typeof value === "string") {
+            secrets[name] = value;
+        }
+    }
+    return secrets;
+}
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
+    const secrets = parseBoundSecrets(path);
+    if (secrets === undefined) {
+        return;
+    }
+    for (const name of appliedSecretNames) {
+        if (!(name in secrets)) {
+            delete process.env[name];
+        }
+    }
+    appliedSecretNames.clear();
+    for (const [name, value] of Object.entries(secrets)) {
+        process.env[name] = value;
+        appliedSecretNames.add(name);
+    }
+}

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -12,4 +12,15 @@ export declare const DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE = "/run/
 export declare function resolveDeploymentStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
 /** Engine framework store: env, then task-bind file. */
 export declare function resolveFrameworkStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
+export type CursorManagedV2StoreIds = {
+    deploymentStoreSourceId: string;
+    frameworkStoreSourceId: string;
+};
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export declare function requireCursorManagedV2StoreIdsSync(env?: NodeJS.ProcessEnv): CursorManagedV2StoreIds;
 //# sourceMappingURL=hosted-store-secrets.d.ts.map

package/dist/internal/cursor/hosted-store-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB"}
+{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AA4B9D,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAYzB"}

package/dist/internal/cursor/hosted-store-secrets.js

@@ -46,3 +46,18 @@ export function resolveFrameworkStoreSourceIdSync(env = process.env) {
     }
     return readBoundSecretFile(FRAMEWORK_STORE_SOURCE_ID_FILE_ENV, DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE, env);
 }
+/**
+ * Resolve the complete managed-v2 store identity at the process boundary.
+ *
+ * Freeze snapshots construct storage before task bind, so callers keep this
+ * resolver lazy. Once an operation needs storage, both ids are mandatory.
+ */
+export function requireCursorManagedV2StoreIdsSync(env = process.env) {
+    const deploymentStoreSourceId = resolveDeploymentStoreSourceIdSync(env);
+    const frameworkStoreSourceId = resolveFrameworkStoreSourceIdSync(env);
+    if (deploymentStoreSourceId === undefined ||
+        frameworkStoreSourceId === undefined) {
+        throw new Error("Cursor-managed AgentSDK v2 requires AGENT_SERVE_STORE_SOURCE_ID and AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID");
+    }
+    return { deploymentStoreSourceId, frameworkStoreSourceId };
+}

package/dist/internal/cursor-deployment-relay.d.ts

@@ -18,22 +18,36 @@ export interface ResolvedSubscription {
     environments: string[];
     events: Set<DeploymentEventType>;
 }
+export type DeploymentSubscriptionSource = readonly ResolvedSubscription[] | (() => readonly ResolvedSubscription[]);
 export interface DeploymentEventRelayOptions {
     baseUrl: string;
     apiKey: string;
     stateDir: string;
-    subscriptions: readonly ResolvedSubscription[];
+    /**
+     * Snapshot or a getter. A getter is re-read on every registration
+     * heartbeat so a channel that refreshes `deploySourceUris` after start
+     * can add sources without restarting the relay.
+     */
+    subscriptions: DeploymentSubscriptionSource;
     dispatch: (event: DeploymentEvent) => Promise<void>;
     logger: (line: string) => void;
     fetchImpl?: typeof fetch;
     pollWaitMs?: number;
 }
+/** Current subscriptions: a live getter, otherwise the snapshot. */
+export declare function currentDeploymentSubscriptions(subscriptions: DeploymentSubscriptionSource): readonly ResolvedSubscription[];
 /** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
 export declare function resolveDeploymentSubscriptions(options: {
     deploySourceUris: readonly (string | DeploymentSubscription)[];
     environments?: readonly string[];
     events?: readonly DeploymentEventType[];
 }): ResolvedSubscription[];
+/**
+ * Union per-channel subscriptions, widening events and environments when
+ * the same deploy source appears more than once. An empty environment
+ * list means every environment and absorbs a narrower list.
+ */
+export declare function mergeResolvedSubscriptions(groups: readonly (readonly ResolvedSubscription[])[]): ResolvedSubscription[];
 /** Whether one confirmed subscription wants this event. */
 export declare function deploymentEventMatches(subscription: ResolvedSubscription, envelope: DeploymentEvent): boolean;
 /** One channel the host can deliver a deployment event to. */

package/dist/internal/cursor-deployment-relay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAkEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}
+{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,MAAM,4BAA4B,GACpC,SAAS,oBAAoB,EAAE,GAC/B,CAAC,MAAM,SAAS,oBAAoB,EAAE,CAAC,CAAC;AAE5C,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,aAAa,EAAE,4BAA4B,GAC1C,SAAS,oBAAoB,EAAE,CAEjC;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA8CzB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACnD,oBAAoB,EAAE,CA2BxB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,YAA6B,OAAO,EAAE,2BAA2B,EAuEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}

package/dist/internal/cursor-deployment-relay.js

@@ -29,6 +29,10 @@ var __rest = (this && this.__rest) || function (s, e) {
 };
 import { CursorRelayCore } from "./cursor-relay-core.js";
 const DEFAULT_EVENTS = ["deployment.succeeded"];
+/** Current subscriptions: a live getter, otherwise the snapshot. */
+export function currentDeploymentSubscriptions(subscriptions) {
+    return typeof subscriptions === "function" ? subscriptions() : subscriptions;
+}
 /** Normalize the channel's `deploySourceUris` option into concrete subscriptions. */
 export function resolveDeploymentSubscriptions(options) {
     var _a, _b, _c, _d;
@@ -64,10 +68,44 @@ export function resolveDeploymentSubscriptions(options) {
                 ? []
                 : [...new Set([...existing.environments, ...environments])];
     }
-    // Empty is legal here and means "this channel wants nothing", which is how
-    // an env-configured channel stays inert without a deploy-source list. The
-    // wire-level empty list means deregister, so the host simply never
-    // registers it.
+    // Empty is legal here and means "this channel wants nothing". The
+    // wire-level empty list means deregister. The host re-resolves on each
+    // heartbeat, so a channel that later fills `deploySourceUris` can
+    // register without a restart.
+    return [...bySource.values()];
+}
+/**
+ * Union per-channel subscriptions, widening events and environments when
+ * the same deploy source appears more than once. An empty environment
+ * list means every environment and absorbs a narrower list.
+ */
+export function mergeResolvedSubscriptions(groups) {
+    const bySource = new Map();
+    for (const group of groups) {
+        for (const subscription of group) {
+            const existing = bySource.get(subscription.deploySourceUri);
+            if (existing === undefined) {
+                bySource.set(subscription.deploySourceUri, {
+                    deploySourceUri: subscription.deploySourceUri,
+                    environments: [...subscription.environments],
+                    events: new Set(subscription.events),
+                });
+                continue;
+            }
+            for (const event of subscription.events)
+                existing.events.add(event);
+            existing.environments =
+                existing.environments.length === 0 ||
+                    subscription.environments.length === 0
+                    ? []
+                    : [
+                        ...new Set([
+                            ...existing.environments,
+                            ...subscription.environments,
+                        ]),
+                    ];
+        }
+    }
     return [...bySource.values()];
 }
 /** Whether one confirmed subscription wants this event. */
@@ -119,7 +157,7 @@ export class DeploymentEventRelay {
             pollPath: "/v0/deployment-events",
             buildRegistrationBody: (consumerId) => ({
                 consumerId,
-                subscriptions: options.subscriptions.map((subscription) => ({
+                subscriptions: currentDeploymentSubscriptions(options.subscriptions).map((subscription) => ({
                     deploySourceUri: subscription.deploySourceUri,
                     environments: subscription.environments,
                     events: [...subscription.events],
@@ -134,12 +172,13 @@ export class DeploymentEventRelay {
             applyRegistrationResponse: (json) => {
                 var _a, _b;
                 const result = json;
+                const wantedSubscriptions = currentDeploymentSubscriptions(options.subscriptions);
                 this.subscribed = new Map();
                 this.loggedSkippedSources.clear();
                 const lines = [];
                 const confirmed = [];
                 for (const status of (_a = result.deploySourceUris) !== null && _a !== void 0 ? _a : []) {
-                    const wanted = options.subscriptions.find((subscription) => subscription.deploySourceUri === status.deploySourceUri);
+                    const wanted = wantedSubscriptions.find((subscription) => subscription.deploySourceUri === status.deploySourceUri);
                     if (!status.isSubscribed || wanted === undefined) {
                         lines.push(`not subscribed to ${status.deploySourceUri}: ${(_b = status.detail) !== null && _b !== void 0 ? _b : "unknown reason"}`);
                         continue;
@@ -149,7 +188,7 @@ export class DeploymentEventRelay {
                 }
                 if (confirmed.length > 0) {
                     const kinds = [
-                        ...new Set(options.subscriptions.flatMap((s) => [...s.events])),
+                        ...new Set(wantedSubscriptions.flatMap((s) => [...s.events])),
                     ];
                     lines.push(`subscribed to ${confirmed.join(", ")} for events: ${kinds.join(", ")}`);
                 }

package/dist/internal/deploy-client.d.ts

@@ -169,6 +169,8 @@ export interface AgentkitDeployStatus {
      * Absent on control planes that predate the field.
      */
     repositories?: string[];
+    /** Names of application-scoped secrets (values are never returned). */
+    secretNames?: string[];
 }
 export declare const TERMINAL_AGENTKIT_DEPLOY_STATUSES: ReadonlySet<AgentkitCustomerStatus>;
 /**
@@ -289,17 +291,38 @@ export declare class AgentServeDeployClient {
             value: string;
         }>;
     }): Promise<string[]>;
+    /** Upsert application-scoped secrets on an AgentSDK v2 deployment. */
+    setAgentkitSecrets(args: {
+        teamId: number;
+        slug: string;
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+    }): Promise<string[]>;
     /** Secret names + creation times; values are never returned. */
     listSecrets(args: {
         teamId: number;
         slug: string;
     }): Promise<SecretInfo[]>;
+    /** Secret names + creation times for an AgentSDK v2 application. */
+    listAgentkitSecrets(args: {
+        teamId: number;
+        slug: string;
+    }): Promise<SecretInfo[]>;
     /** Remove one secret by name; 404 when it is not set. */
     deleteSecret(args: {
         teamId: number;
         slug: string;
         name: string;
     }): Promise<void>;
+    /** Remove one application-scoped secret from an AgentSDK v2 deployment. */
+    deleteAgentkitSecret(args: {
+        teamId: number;
+        slug: string;
+        name: string;
+    }): Promise<void>;
+    private validateSecrets;
     /**
      * Rotate the deployment's pod credential. Returns the masked new key —
      * the raw key is injected into the pod on the next deploy, never

package/dist/internal/deploy-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-client.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,WAAW,GACX,SAAS,GACT,UAAU,GACV,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,CAAC;AAEf,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAEf,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,gBAAgB,CAKjE,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAIF,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtE;AAED,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM;IAJrC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,oEAAoE;IAC3D,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAIpC;CACF;AASD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,GAC/C,MAAM,GAAG,SAAS,CAOpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,WAAW,GACX,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,GACR,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,sBAAsB,CACvC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAoMD,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IAEzC,YAAY,OAAO,EAAE,6BAA6B,EAMjD;IAED,yEAAyE;IACnE,MAAM,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,YAAY,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAyD1B;IAED;;;;;;OAMG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;QACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,kEAAkE;QAClE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiClC;IAEK,iBAAiB,CAAC,IAAI,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;IAED;;;OAGG;IACG,YAAY,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;IAEK,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOrE;IAEK,aAAa,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAO5B;IAEK,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,YAAY,CAAC,CAOxB;IAEK,gBAAgB,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,cAAc,CAAC,CAO1B;IAED,sEAAsE;IAChE,gBAAgB,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;IAED;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BpB;IAED,gEAAgE;IAC1D,WAAW,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOxB;IAED,yDAAyD;IACnD,YAAY,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;IAED;;;;OAIG;IACG,mBAAmB,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsBxE;IAED,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;YAEa,OAAO;CAyCtB;AAKD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoB9C"}
+{"version":3,"file":"deploy-client.d.ts","sourceRoot":"","sources":["../../src/internal/deploy-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,WAAW,GACX,SAAS,GACT,UAAU,GACV,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,CAAC;AAEf,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAEf,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,gBAAgB,CAKjE,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AAIF,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvE;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtE;AAED,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM;IAJrC,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,oEAAoE;IAC3D,iBAAiB,CAAC,EAAE,MAAM,YAAA,EAIpC;CACF;AASD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,GAC/C,MAAM,GAAG,SAAS,CAOpB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,WAAW,GACX,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAC9B,QAAQ,GACR,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,sBAAsB,CACvC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,yBAAyB,EAAE,CAAC;CACzC;AAqMD,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IAEzC,YAAY,OAAO,EAAE,6BAA6B,EAMjD;IAED,yEAAyE;IACnE,MAAM,CAAC,IAAI,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,YAAY,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAyD1B;IAED;;;;;;OAMG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,uBAAuB,EAAE,CAAC;QACvC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,kEAAkE;QAClE,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiClC;IAEK,iBAAiB,CAAC,IAAI,EAAE;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;IAED;;;OAGG;IACG,YAAY,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOhC;IAEK,eAAe,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOrE;IAEK,aAAa,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAO5B;IAEK,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,YAAY,CAAC,CAOxB;IAEK,gBAAgB,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,cAAc,CAAC,CAO1B;IAED,sEAAsE;IAChE,gBAAgB,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;IAED;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASpB;IAED,sEAAsE;IAChE,kBAAkB,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASpB;IAED,gEAAgE;IAC1D,WAAW,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOxB;IAED,oEAAoE;IAC9D,mBAAmB,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOxB;IAED,yDAAyD;IACnD,YAAY,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;IAED,2EAA2E;IACrE,oBAAoB,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;IAED,OAAO,CAAC,eAAe;IAuBvB;;;;OAIG;IACG,mBAAmB,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAOlB;IAED;;;;;OAKG;IACG,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsBxE;IAED,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;YAEa,OAAO;CAyCtB;AAKD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GACV;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoB9C"}

package/dist/internal/deploy-client.js

@@ -112,6 +112,7 @@ const agentkitDeployStatusSchema = z
     statusMessage: z.string().nullable(),
     // Optional: backends that predate the v2 bake-failure column omit it.
     lastError: z.string().nullable().optional(),
+    secretNames: z.array(z.string()).optional(),
 })
     .passthrough();
 const agentkitStopAcceptedSchema = z
@@ -414,18 +415,7 @@ export class AgentServeDeployClient {
      */
     setSecrets(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            for (const { name, value } of args.secrets) {
-                const nameError = validateSettableSecretName(name);
-                if (nameError !== undefined) {
-                    throw new DeployApiError(nameError, 400);
-                }
-                if (Buffer.byteLength(value, "utf8") > MAX_SECRET_VALUE_BYTES) {
-                    throw new DeployApiError(`The value for ${name} is too large (max ${MAX_SECRET_VALUE_BYTES} bytes).`, 400);
-                }
-            }
-            if (args.secrets.length > MAX_SECRETS) {
-                throw new DeployApiError(`Too many secrets in one request (${args.secrets.length}); deployments hold at most ${MAX_SECRETS}.`, 400);
-            }
+            this.validateSecrets(args.secrets);
             const raw = yield this.request({
                 method: "PUT",
                 path: `/internal/agent-serve/deployments/${encodeURIComponent(args.slug)}/secrets`,
@@ -435,6 +425,19 @@ export class AgentServeDeployClient {
             return setSecretsResponseSchema.parse(raw).secretNames;
         });
     }
+    /** Upsert application-scoped secrets on an AgentSDK v2 deployment. */
+    setAgentkitSecrets(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.validateSecrets(args.secrets);
+            const raw = yield this.request({
+                method: "PUT",
+                path: `/internal/agentsdk/deployments/${encodeURIComponent(args.slug)}/secrets`,
+                body: { teamId: args.teamId, secrets: args.secrets },
+                context: { verb: "set secrets", slug: args.slug },
+            });
+            return setSecretsResponseSchema.parse(raw).secretNames;
+        });
+    }
     /** Secret names + creation times; values are never returned. */
     listSecrets(args) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -446,6 +449,17 @@ export class AgentServeDeployClient {
             return listSecretsResponseSchema.parse(raw).secrets;
         });
     }
+    /** Secret names + creation times for an AgentSDK v2 application. */
+    listAgentkitSecrets(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const raw = yield this.request({
+                method: "GET",
+                path: `/internal/agentsdk/deployments/${encodeURIComponent(args.slug)}/secrets?teamId=${args.teamId}`,
+                context: { verb: "list secrets", slug: args.slug },
+            });
+            return listSecretsResponseSchema.parse(raw).secrets;
+        });
+    }
     /** Remove one secret by name; 404 when it is not set. */
     deleteSecret(args) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -460,6 +474,34 @@ export class AgentServeDeployClient {
             });
         });
     }
+    /** Remove one application-scoped secret from an AgentSDK v2 deployment. */
+    deleteAgentkitSecret(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const nameError = validateSettableSecretName(args.name);
+            if (nameError !== undefined) {
+                throw new DeployApiError(nameError, 400);
+            }
+            yield this.request({
+                method: "DELETE",
+                path: `/internal/agentsdk/deployments/${encodeURIComponent(args.slug)}/secrets/${encodeURIComponent(args.name)}?teamId=${args.teamId}`,
+                context: { verb: "unset secret", slug: args.slug },
+            });
+        });
+    }
+    validateSecrets(secrets) {
+        for (const { name, value } of secrets) {
+            const nameError = validateSettableSecretName(name);
+            if (nameError !== undefined) {
+                throw new DeployApiError(nameError, 400);
+            }
+            if (Buffer.byteLength(value, "utf8") > MAX_SECRET_VALUE_BYTES) {
+                throw new DeployApiError(`The value for ${name} is too large (max ${MAX_SECRET_VALUE_BYTES} bytes).`, 400);
+            }
+        }
+        if (secrets.length > MAX_SECRETS) {
+            throw new DeployApiError(`Too many secrets in one request (${secrets.length}); deployments hold at most ${MAX_SECRETS}.`, 400);
+        }
+    }
     /**
      * Rotate the deployment's pod credential. Returns the masked new key —
      * the raw key is injected into the pod on the next deploy, never

package/dist/internal/discovery/ab.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `agent/ab.ts` or `agent/ab/*.ts` plus `agent/ab.config.ts`: live A/B experiments.
+ */
+import type { ABConfigFile } from "../../ab.js";
+import type { DiscoveredAB } from "../../types.js";
+import { type DiscoveryContext } from "./context.js";
+export declare function loadABs(ctx: DiscoveryContext, agentDir: string): Promise<DiscoveredAB[]>;
+export declare function loadABConfig(ctx: DiscoveryContext, agentDir: string): Promise<ABConfigFile | undefined>;
+//# sourceMappingURL=ab.d.ts.map

package/dist/internal/discovery/ab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ab.d.ts","sourceRoot":"","sources":["../../../src/internal/discovery/ab.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,KAAK,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAUlE,wBAAsB,OAAO,CAC3B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CA+CzB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAyBnC"}