@cursor/july 0.1.102 → 0.1.104

package/dist/channels/bitbucket/bitbucket-webhook.js

@@ -0,0 +1,394 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
+import { continuationSource } from "../../internal/continuation-identity.js";
+import { bindLocalIngressSend } from "../../internal/local-ingress.js";
+import { asNonEmptyString, asPositiveInt, asRecord, bitbucketCommentFromPayload, bitbucketPullRequestFromPayload, bitbucketPullRequestRecord, bitbucketPullRequestUrl, bitbucketPushFromPayload, bitbucketRepositoryFromPayload, bitbucketUser, buildBitbucketBinding, } from "./binding.js";
+import { defaultBitbucketPullRequestDispatch, defaultBitbucketPullRequestMessage, defaultBitbucketTitle, } from "./defaults.js";
+import { BITBUCKET_CHANNEL_KIND, BITBUCKET_PULL_REQUEST_EVENTS, normalizeBitbucketEventKey, } from "./events.js";
+import { bitbucketChannelStateForEvent, } from "./state.js";
+/** `BITBUCKET_WEBHOOK_SECRET` fallback for {@link BitbucketChannelOptions.webhookSecret}. */
+export function envBitbucketWebhookSecret() {
+    var _a;
+    const value = (_a = process.env.BITBUCKET_WEBHOOK_SECRET) === null || _a === void 0 ? void 0 : _a.trim();
+    return value === undefined || value === "" ? undefined : value;
+}
+export function resolveBitbucketWebhookSecret(options) {
+    const authored = typeof options.webhookSecret === "function"
+        ? options.webhookSecret()
+        : options.webhookSecret;
+    const trimmed = authored === null || authored === void 0 ? void 0 : authored.trim();
+    return trimmed === undefined || trimmed === ""
+        ? envBitbucketWebhookSecret()
+        : trimmed;
+}
+const SIGNATURE_PREFIX = "sha256=";
+/** The `X-Hub-Signature` value Bitbucket sends for a raw body. */
+export function signBitbucketWebhookBody(rawBody, secret) {
+    return `${SIGNATURE_PREFIX}${createHmac("sha256", secret).update(rawBody).digest("hex")}`;
+}
+/**
+ * Both dialects sign the raw body with HMAC-SHA256 in `X-Hub-Signature`
+ * (`sha256=<hex>`, GitHub-shaped). Constant-time compare; a missing or
+ * malformed header is a plain `false`.
+ */
+export function verifyBitbucketWebhookSignature(rawBody, signatureHeader, secret) {
+    if (signatureHeader === null ||
+        signatureHeader === undefined ||
+        !signatureHeader.startsWith(SIGNATURE_PREFIX)) {
+        return false;
+    }
+    const provided = Buffer.from(signatureHeader, "utf8");
+    const computed = Buffer.from(signBitbucketWebhookBody(rawBody, secret), "utf8");
+    return (provided.length === computed.length && timingSafeEqual(provided, computed));
+}
+/**
+ * Accept a raw Bitbucket payload plus the event key. The key comes from
+ * `X-Event-Key` (HTTP) or the hosted envelope; Data Center bodies also carry
+ * it as `eventKey`. Data Center keys are normalized to the Cloud vocabulary.
+ *
+ * The body's `eventKey` is authoritative when present: `X-Hub-Signature`
+ * covers the body but not the header, so a captured signed Data Center
+ * delivery must not be re-dispatched as a different event by rewriting the
+ * header. A header that disagrees with the signed body rejects the delivery.
+ *
+ * Cloud bodies carry no `eventKey`, but each event family has a signed
+ * discriminator object (`comment`, `approval`, `changes_request`, `push`).
+ * A header naming a family the body does not match — e.g. a signed
+ * `pullrequest:comment_created` body replayed as `pullrequest:created` —
+ * is rejected the same way. `created` vs `updated` bodies are shape-identical
+ * and cannot be told apart without the key.
+ */
+export function parseBitbucketWebhookPayload(payload, eventKey) {
+    const record = asRecord(payload);
+    if (record === undefined) {
+        return null;
+    }
+    const fromBody = asNonEmptyString(record.eventKey);
+    const fromHeader = (eventKey === null || eventKey === void 0 ? void 0 : eventKey.trim()) || undefined;
+    if (fromBody !== undefined &&
+        fromHeader !== undefined &&
+        normalizeBitbucketEventKey(fromBody) !==
+            normalizeBitbucketEventKey(fromHeader)) {
+        return null;
+    }
+    const raw = fromBody !== null && fromBody !== void 0 ? fromBody : fromHeader;
+    if (raw === undefined) {
+        return null;
+    }
+    const eventType = normalizeBitbucketEventKey(raw);
+    if (fromBody === undefined &&
+        bitbucketCloudEventFamily(eventType) !== cloudBodyFamily(record)) {
+        return null;
+    }
+    return {
+        eventType,
+        rawEventType: raw,
+        payload: record,
+    };
+}
+/** Event family a Cloud key belongs to, by its signed body discriminator. */
+function bitbucketCloudEventFamily(eventType) {
+    if (eventType.startsWith("repo:")) {
+        return eventType === "repo:push" ? "push" : "other";
+    }
+    if (!eventType.startsWith("pullrequest:")) {
+        return "other";
+    }
+    const action = eventType.slice("pullrequest:".length);
+    if (action.startsWith("comment_")) {
+        return "comment";
+    }
+    if (action === "approved" || action === "unapproved") {
+        return "approval";
+    }
+    if (action.startsWith("changes_request_")) {
+        return "changes_request";
+    }
+    return "pull_request";
+}
+/** Event family a Cloud body proves by the discriminator object it carries. */
+function cloudBodyFamily(record) {
+    if (asRecord(record.comment) !== undefined) {
+        return "comment";
+    }
+    if (asRecord(record.approval) !== undefined) {
+        return "approval";
+    }
+    if (asRecord(record.changes_request) !== undefined) {
+        return "changes_request";
+    }
+    if (asRecord(record.push) !== undefined) {
+        return "push";
+    }
+    return asRecord(record.pullrequest) !== undefined ? "pull_request" : "other";
+}
+function configuredRepoAllowlist(options) {
+    const repos = [];
+    if (options.repos !== undefined) {
+        repos.push(...options.repos);
+    }
+    if (typeof options.cursorAccount === "object") {
+        repos.push(...options.cursorAccount.repos);
+    }
+    const normalized = repos
+        .map((repo) => repo
+        .trim()
+        .replace(/^\/+|\/+$/g, "")
+        .toLowerCase())
+        .filter(Boolean);
+    return normalized.length === 0 ? undefined : new Set(normalized);
+}
+function isPullRequestEvent(eventType) {
+    return BITBUCKET_PULL_REQUEST_EVENTS.includes(eventType);
+}
+export function parseBitbucketEventContext(delivery) {
+    var _a, _b;
+    var _c;
+    const repository = bitbucketRepositoryFromPayload(delivery.payload);
+    if (repository === undefined) {
+        return null;
+    }
+    const pullRequestRecord = bitbucketPullRequestRecord(delivery.payload);
+    const pullRequestId = asPositiveInt(pullRequestRecord === null || pullRequestRecord === void 0 ? void 0 : pullRequestRecord.id);
+    return Object.assign(Object.assign({ deliveryId: delivery.deliveryId, eventType: delivery.eventType, rawEventType: (_c = delivery.rawEventType) !== null && _c !== void 0 ? _c : delivery.eventType, repository }, (pullRequestId === undefined
+        ? {}
+        : {
+            pullRequestId,
+            pullRequestUrl: bitbucketPullRequestUrl(repository, pullRequestId, asNonEmptyString((_b = asRecord((_a = asRecord(pullRequestRecord === null || pullRequestRecord === void 0 ? void 0 : pullRequestRecord.links)) === null || _a === void 0 ? void 0 : _a.html)) === null || _b === void 0 ? void 0 : _b.href)),
+        })), { payload: delivery.payload, sender: bitbucketUser(delivery.payload.actor) });
+}
+function invalidPayload(error) {
+    return Response.json({ ok: false, error }, { status: 400 });
+}
+function startTurn(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const source = continuationSource(input.options.continuation, "bitbucket");
+        const session = yield input.args.send(input.message, Object.assign(Object.assign(Object.assign(Object.assign({ auth: input.dispatch.auth }, (source === "engine" && input.ctx.pullRequestId !== undefined
+            ? {
+                continuationToken: `bitbucket-pr:${input.ctx.repository.fullName.toLowerCase()}#${input.ctx.pullRequestId}`,
+            }
+            : {})), { title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultBitbucketTitle(input.ctx) }), (input.cloud === undefined ? {} : { cloud: input.cloud })), { state: input.state, refreshState: input.state }));
+        return turnStarted(session);
+    });
+}
+function resolveCloudOptions(cloud, ctx, pullRequest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (cloud === undefined || cloud === false) {
+            return undefined;
+        }
+        if (cloud === true) {
+            const url = (_a = ctx.repository.htmlUrl) !== null && _a !== void 0 ? _a : (ctx.repository.dialect === "cloud"
+                ? `https://bitbucket.org/${ctx.repository.fullName}`
+                : undefined);
+            if (url === undefined) {
+                return undefined;
+            }
+            return {
+                repos: [
+                    {
+                        url,
+                        prUrl: pullRequest.htmlUrl,
+                        startingRef: pullRequest.headSha,
+                    },
+                ],
+            };
+        }
+        if (typeof cloud === "function") {
+            return yield cloud(ctx, pullRequest);
+        }
+        return cloud;
+    });
+}
+function applyDispatch(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        if (input.dispatch === null) {
+            return skipped("not_dispatched", input.extra);
+        }
+        if (isTaskDispatch(input.dispatch)) {
+            return acknowledgeTask(input.args, BITBUCKET_CHANNEL_KIND, input.dispatch, input.extra);
+        }
+        const message = [
+            (_a = input.dispatch.message) !== null && _a !== void 0 ? _a : input.message,
+            ...((_b = input.dispatch.context) !== null && _b !== void 0 ? _b : []),
+        ].join("\n");
+        return startTurn({
+            options: input.options,
+            args: input.args,
+            ctx: input.ctx,
+            message,
+            dispatch: input.dispatch,
+            cloud: input.cloud,
+            state: bitbucketChannelStateForEvent({
+                repository: input.ctx.repository,
+                pullRequestId: input.ctx.pullRequestId,
+                headSha: input.headSha,
+                deliveryId: input.ctx.deliveryId,
+                eventType: input.ctx.eventType,
+                triggeringCommentId: input.triggeringCommentId,
+            }),
+        });
+    });
+}
+/**
+ * Run the authored hooks for one Bitbucket delivery and `send()` the turn.
+ * Callers own delivery auth: the HTTP route verifies `X-Hub-Signature`;
+ * hosted admission arrives verified. The v2 mailbox is stamped upstream
+ * (local CP or hosted ingress), never here.
+ */
+export function dispatchBitbucketWebhook(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const { eventType, payload } = input.delivery;
+        const parsed = parseBitbucketEventContext(input.delivery);
+        if (parsed === null) {
+            return invalidPayload("invalid_bitbucket_payload");
+        }
+        const args = input.args;
+        const ctx = Object.assign(Object.assign({}, parsed), { bitbucket: buildBitbucketBinding({
+                repository: parsed.repository,
+                proxy: (_a = input.proxy) === null || _a === void 0 ? void 0 : _a.call(input),
+                token: input.options.token,
+                apiBaseUrl: input.options.apiBaseUrl,
+            }), host: args.host, artifacts: args.artifacts, send: args.send });
+        const allowlist = configuredRepoAllowlist(input.options);
+        if (allowlist !== undefined &&
+            !allowlist.has(ctx.repository.fullName.toLowerCase())) {
+            return skipped("repo_not_allowed", { repo: ctx.repository.fullName });
+        }
+        const extra = { event: eventType, rawEvent: ctx.rawEventType };
+        if (isPullRequestEvent(eventType)) {
+            const action = eventType.slice("pullrequest:".length);
+            const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, action);
+            if (pullRequest === undefined) {
+                return invalidPayload("invalid_bitbucket_pull_request_payload");
+            }
+            const dispatch = input.options.onPullRequest === undefined
+                ? defaultBitbucketPullRequestDispatch(ctx, pullRequest)
+                : yield input.options.onPullRequest(ctx, pullRequest);
+            return applyDispatch({
+                options: input.options,
+                args,
+                ctx,
+                dispatch,
+                extra: Object.assign(Object.assign({}, extra), { action }),
+                message: defaultBitbucketPullRequestMessage(ctx, pullRequest),
+                cloud: yield resolveCloudOptions(input.options.cloud, ctx, pullRequest),
+                headSha: pullRequest.headSha,
+            });
+        }
+        switch (eventType) {
+            case "pullrequest:comment_created": {
+                if (input.options.onPullRequestComment === undefined) {
+                    return skipped("no_handler", extra);
+                }
+                const comment = bitbucketCommentFromPayload(payload);
+                const pullRequest = bitbucketPullRequestFromPayload(ctx.repository, payload, "comment_created");
+                if (comment === undefined || pullRequest === undefined) {
+                    return invalidPayload("invalid_bitbucket_comment_payload");
+                }
+                const dispatch = yield input.options.onPullRequestComment(ctx, comment, pullRequest);
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: `Bitbucket comment on ${ctx.repository.fullName}#${pullRequest.id}`,
+                    headSha: pullRequest.headSha,
+                    triggeringCommentId: comment.id,
+                });
+            }
+            case "repo:push": {
+                if (input.options.onPush === undefined) {
+                    return skipped("no_handler", extra);
+                }
+                const push = bitbucketPushFromPayload(payload);
+                if (push === undefined) {
+                    return invalidPayload("invalid_bitbucket_push_payload");
+                }
+                const dispatch = yield input.options.onPush(ctx, push);
+                const first = push.changes[0];
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: `Bitbucket push to ${ctx.repository.fullName}${(first === null || first === void 0 ? void 0 : first.name) === undefined ? "" : ` ${first.name}`}`,
+                    headSha: first === null || first === void 0 ? void 0 : first.after,
+                });
+            }
+            default: {
+                if (input.options.onEvent === undefined) {
+                    return skipped("unsupported_event", extra);
+                }
+                const dispatch = yield input.options.onEvent(ctx, {
+                    eventType,
+                    rawEventType: ctx.rawEventType,
+                    payload,
+                });
+                return applyDispatch({
+                    options: input.options,
+                    args,
+                    ctx,
+                    dispatch,
+                    extra,
+                    message: `Bitbucket ${eventType} event on ${ctx.repository.fullName}`,
+                });
+            }
+        }
+    });
+}
+/**
+ * HTTP entry for a single agent's Bitbucket channel: `X-Hub-Signature` HMAC
+ * when a secret is configured, then {@link dispatchBitbucketWebhook}.
+ * Without a secret the route auth owns admission (`serve --dev` admits
+ * loopback only; production stays loopback-strict).
+ */
+export function handleBitbucketWebhookRequest(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const bodyText = yield input.request.text();
+        const secret = resolveBitbucketWebhookSecret(input.options);
+        if (secret !== undefined && input.skipSignatureVerification !== true) {
+            if (!verifyBitbucketWebhookSignature(bodyText, input.request.headers.get("x-hub-signature"), secret)) {
+                return Response.json({ ok: false, error: "invalid_signature" }, { status: 401 });
+            }
+        }
+        let payload;
+        try {
+            payload = JSON.parse(bodyText);
+        }
+        catch (_c) {
+            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+        }
+        const delivery = parseBitbucketWebhookPayload(payload, input.request.headers.get("x-event-key"));
+        if (delivery === null) {
+            return invalidPayload("invalid_bitbucket_payload");
+        }
+        delivery.deliveryId = (_b = (_a = input.request.headers.get("x-request-uuid")) !== null && _a !== void 0 ? _a : input.request.headers.get("x-request-id")) !== null && _b !== void 0 ? _b : undefined;
+        return dispatchBitbucketWebhook({
+            options: input.options,
+            delivery,
+            proxy: input.proxy,
+            args: bindLocalIngressSend(input.args, {
+                identity: input.options.continuation,
+                kind: BITBUCKET_CHANNEL_KIND,
+                eventType: delivery.eventType,
+                payload: delivery.payload,
+            }),
+        });
+    });
+}

package/dist/channels/bitbucket/checks.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Bitbucket build statuses — the Bitbucket {@link CiCheckWriter} behind the
+ * shared check lifecycle in `../checks.js`.
+ *
+ * Bitbucket has no Checks API; the PR page shows **build statuses** keyed
+ * by `(commit, key)`. Cloud: `POST /repositories/{ws}/{slug}/commit/{sha}/
+ * statuses/build`; Data Center: `POST /projects/{KEY}/repos/{slug}/commits/
+ * {sha}/builds`. The writer maps the shared status / conclusion pair onto
+ * Bitbucket's state set and re-posts the full desired state on every write,
+ * so `resumeBitbucketCheck` needs only `(sha, key)` to rebuild a handle.
+ */
+import { type CiCheck, type CiCheckConcludeInput, type CiCheckConclusion, type CiCheckCreateInput, type CiCheckOutput, type CiCheckRef, type CiCheckStatus, type CiChecksClient, type CiCheckUpdateInput } from "../checks.js";
+import type { BitbucketApi, BitbucketBuildStatusState } from "./api.js";
+/** Anything that can post a Bitbucket build status. */
+export type BitbucketCheckClient = Pick<BitbucketApi, "setBuildStatus">;
+/** Shared check status / conclusion → Bitbucket build-status state. */
+export declare function bitbucketBuildStatusState(input: {
+    status: CiCheckStatus;
+    conclusion?: CiCheckConclusion;
+}): BitbucketBuildStatusState;
+export type BitbucketCheckOutput = CiCheckOutput;
+export type BitbucketCheckUpdateInput = CiCheckUpdateInput;
+export type BitbucketCheckConcludeInput = CiCheckConcludeInput;
+/** A created build status. All methods throw `BitbucketApiError` on failure. */
+export type BitbucketCheck = CiCheck & CiCheckRef;
+export interface BitbucketCheckIdentityInput {
+    /** Client used for every API call on the returned handle. */
+    bitbucket: BitbucketCheckClient;
+    /** Status key shown on the PR, e.g. `"cursor/security-review"`. */
+    name: string;
+    /** Commit the status attaches to (usually the PR head SHA). */
+    sha: string;
+}
+export interface BitbucketCheckCreateInput extends BitbucketCheckIdentityInput, CiCheckCreateInput {
+}
+/**
+ * Open a build status on `sha` and return a handle for later updates.
+ *
+ * ```ts
+ * const check = await createBitbucketCheck({
+ *   bitbucket: ctx.bitbucket.api,
+ *   name: "cursor/security-review",
+ *   sha: pullRequest.headSha,
+ *   detailsUrl: sessionUrl,
+ *   output: { title: "Running…", summary: "" },
+ * });
+ * await check.conclude({ conclusion: "success", output: { title: "Clean", summary: "" } });
+ * ```
+ */
+export declare function createBitbucketCheck(input: BitbucketCheckCreateInput): Promise<BitbucketCheck>;
+/**
+ * Rebuild a {@link BitbucketCheck} handle for an existing status row from
+ * its identity. No API call is made until the first update.
+ */
+export declare function resumeBitbucketCheck(input: BitbucketCheckIdentityInput & {
+    /** Last known status; defaults to `"in_progress"`. */
+    status?: CiCheckStatus;
+    url?: string;
+}): BitbucketCheck;
+/**
+ * Repo-bound checks adapter satisfying the shared {@link CiChecksClient}
+ * contract for forge-agnostic check code.
+ */
+export declare function bindBitbucketChecks(input: {
+    bitbucket: BitbucketCheckClient;
+}): CiChecksClient;
+//# sourceMappingURL=checks.d.ts.map

package/dist/channels/bitbucket/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EAIxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAExE,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAExE,uEAAuE;AACvE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,CAAC,EAAE,iBAAiB,CAAC;CAChC,GAAG,yBAAyB,CAiB5B;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AACjD,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAE/D,gFAAgF;AAChF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,CAAC;AAElD,MAAM,WAAW,2BAA2B;IAC1C,6DAA6D;IAC7D,SAAS,EAAE,oBAAoB,CAAC;IAChC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,yBACf,SAAQ,2BAA2B,EACjC,kBAAkB;CAAG;AAiCzB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,cAAc,CAAC,CAEzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,2BAA2B,GAAG;IACnC,sDAAsD;IACtD,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,cAAc,CAKhB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,SAAS,EAAE,oBAAoB,CAAC;CACjC,GAAG,cAAc,CAKjB"}

package/dist/channels/bitbucket/checks.js

@@ -0,0 +1,102 @@
+/**
+ * Bitbucket build statuses — the Bitbucket {@link CiCheckWriter} behind the
+ * shared check lifecycle in `../checks.js`.
+ *
+ * Bitbucket has no Checks API; the PR page shows **build statuses** keyed
+ * by `(commit, key)`. Cloud: `POST /repositories/{ws}/{slug}/commit/{sha}/
+ * statuses/build`; Data Center: `POST /projects/{KEY}/repos/{slug}/commits/
+ * {sha}/builds`. The writer maps the shared status / conclusion pair onto
+ * Bitbucket's state set and re-posts the full desired state on every write,
+ * so `resumeBitbucketCheck` needs only `(sha, key)` to rebuild a handle.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { openCiCheck, resumeCiCheck, } from "../checks.js";
+/** Shared check status / conclusion → Bitbucket build-status state. */
+export function bitbucketBuildStatusState(input) {
+    if (input.status === "queued" || input.status === "in_progress") {
+        return "INPROGRESS";
+    }
+    switch (input.conclusion) {
+        case "success":
+        case "neutral":
+        case "skipped":
+            return "SUCCESSFUL";
+        case "cancelled":
+            return "STOPPED";
+        case "failure":
+        case "action_required":
+        case "timed_out":
+        case undefined:
+            return "FAILED";
+    }
+}
+/**
+ * Bitbucket writer: every write re-posts the status row for `(sha, key)`.
+ * Tracks the last written status so an output-only update keeps the state.
+ * Build statuses have no server id or page URL of their own.
+ */
+function bitbucketCheckWriter(input) {
+    var _a;
+    let lastStatus = (_a = input.status) !== null && _a !== void 0 ? _a : "in_progress";
+    let lastUrl = input.url;
+    return (write) => __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        var _c, _d, _e;
+        const status = (_c = write.status) !== null && _c !== void 0 ? _c : (write.conclusion === undefined ? lastStatus : "completed");
+        lastStatus = status;
+        lastUrl = (_d = write.detailsUrl) !== null && _d !== void 0 ? _d : lastUrl;
+        yield input.bitbucket.setBuildStatus({
+            sha: input.sha,
+            key: input.name,
+            name: (_e = (_a = write.output) === null || _a === void 0 ? void 0 : _a.title) !== null && _e !== void 0 ? _e : input.name,
+            state: bitbucketBuildStatusState({
+                status,
+                conclusion: write.conclusion,
+            }),
+            url: lastUrl,
+            description: (_b = write.output) === null || _b === void 0 ? void 0 : _b.summary,
+        });
+        return lastUrl === undefined ? undefined : { url: lastUrl };
+    });
+}
+/**
+ * Open a build status on `sha` and return a handle for later updates.
+ *
+ * ```ts
+ * const check = await createBitbucketCheck({
+ *   bitbucket: ctx.bitbucket.api,
+ *   name: "cursor/security-review",
+ *   sha: pullRequest.headSha,
+ *   detailsUrl: sessionUrl,
+ *   output: { title: "Running…", summary: "" },
+ * });
+ * await check.conclude({ conclusion: "success", output: { title: "Clean", summary: "" } });
+ * ```
+ */
+export function createBitbucketCheck(input) {
+    return openCiCheck(bitbucketCheckWriter(input), input);
+}
+/**
+ * Rebuild a {@link BitbucketCheck} handle for an existing status row from
+ * its identity. No API call is made until the first update.
+ */
+export function resumeBitbucketCheck(input) {
+    return resumeCiCheck(bitbucketCheckWriter(input), input.url === undefined ? undefined : { url: input.url });
+}
+/**
+ * Repo-bound checks adapter satisfying the shared {@link CiChecksClient}
+ * contract for forge-agnostic check code.
+ */
+export function bindBitbucketChecks(input) {
+    return {
+        createCheck: (check) => createBitbucketCheck(Object.assign(Object.assign({}, check), { bitbucket: input.bitbucket })),
+    };
+}

package/dist/channels/bitbucket/cursor-account.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Cursor-account mode for Bitbucket channels.
+ *
+ * `bitbucketChannel({ cursorAccount })` declares that outbound Bitbucket
+ * calls run through the Cursor SCM proxy (`/v0/bitbucket-proxy`) with the
+ * tenant's credential swapped in server-side. The serve host binds the
+ * Cursor API key and the proxy transport at startup when
+ * `--cursor-scm-proxy` is set; until then `ctx.bitbucket` falls back to
+ * direct `BITBUCKET_TOKEN` access.
+ */
+import type { BitbucketProxyTransport } from "./api.js";
+import type { BitbucketChannelOptions } from "./types.js";
+export declare const CURSOR_BITBUCKET_MAX_REPOS = 20;
+export interface CursorBitbucketRepoScope {
+    /** Lowercased `owner/slug` repos. */
+    repos: readonly string[];
+}
+/** Host-bound credential: Cursor API key + proxy transport, bound at serve. */
+export interface PendingCursorBitbucketCredentials {
+    bind(getApiKey: () => Promise<string>): void;
+    bindProxyTransport(transport: Omit<BitbucketProxyTransport, "getApiKey">): void;
+    /** The full proxy transport once both halves are bound. */
+    getProxyTransport(): BitbucketProxyTransport | undefined;
+}
+export interface BitbucketCursorAccountRuntime {
+    /** Authored channel options (not rewritten). */
+    options: BitbucketChannelOptions;
+    credentials: PendingCursorBitbucketCredentials;
+    scope: CursorBitbucketRepoScope | undefined;
+}
+export declare function parseCursorBitbucketRepoScope(values: readonly string[]): CursorBitbucketRepoScope;
+export declare function createPendingCursorBitbucketCredentials(): PendingCursorBitbucketCredentials;
+/** Bitbucket-proxy base URL (`/v0/bitbucket-proxy`, `AGENT_SERVE_BITBUCKET_PROXY_URL`). */
+export declare function resolveCursorBitbucketProxyUrl(backendBaseUrl: string): string;
+export declare function registerBitbucketCursorAccountRuntime(definition: object, runtime: BitbucketCursorAccountRuntime): void;
+export declare function getBitbucketCursorAccountRuntime(definition: object): BitbucketCursorAccountRuntime | undefined;
+//# sourceMappingURL=cursor-account.d.ts.map

package/dist/channels/bitbucket/cursor-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-account.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/cursor-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAI7C,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,+EAA+E;AAC/E,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC7C,kBAAkB,CAChB,SAAS,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GACpD,IAAI,CAAC;IACR,2DAA2D;IAC3D,iBAAiB,IAAI,uBAAuB,GAAG,SAAS,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B;IAC5C,gDAAgD;IAChD,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,iCAAiC,CAAC;IAC/C,KAAK,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC7C;AAOD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,wBAAwB,CA+B1B;AAED,wBAAgB,uCAAuC,IAAI,iCAAiC,CAiB3F;AAED,2FAA2F;AAC3F,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,6BAA6B,GACrC,IAAI,CAEN;AAED,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,GACjB,6BAA6B,GAAG,SAAS,CAE3C"}

package/dist/channels/bitbucket/cursor-account.js

@@ -0,0 +1,65 @@
+/**
+ * Cursor-account mode for Bitbucket channels.
+ *
+ * `bitbucketChannel({ cursorAccount })` declares that outbound Bitbucket
+ * calls run through the Cursor SCM proxy (`/v0/bitbucket-proxy`) with the
+ * tenant's credential swapped in server-side. The serve host binds the
+ * Cursor API key and the proxy transport at startup when
+ * `--cursor-scm-proxy` is set; until then `ctx.bitbucket` falls back to
+ * direct `BITBUCKET_TOKEN` access.
+ */
+import { resolveCursorScmProxyUrl } from "../github/cursor-account.js";
+export const CURSOR_BITBUCKET_MAX_REPOS = 20;
+/** `workspace/slug` (Cloud) or `PROJECT/slug` (Data Center). */
+const CURSOR_BITBUCKET_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const runtimeByDefinition = new WeakMap();
+export function parseCursorBitbucketRepoScope(values) {
+    const repos = [
+        ...new Set(values
+            .map((repo) => repo
+            .trim()
+            .replace(/^\/+|\/+$/g, "")
+            .toLowerCase())
+            .filter(Boolean)),
+    ];
+    if (repos.length === 0) {
+        throw new Error("bitbucketChannel({ cursorAccount }) requires at least one repo.");
+    }
+    if (repos.length > CURSOR_BITBUCKET_MAX_REPOS) {
+        throw new Error(`bitbucketChannel({ cursorAccount }) supports at most ${CURSOR_BITBUCKET_MAX_REPOS} repos.`);
+    }
+    for (const repo of repos) {
+        if (!CURSOR_BITBUCKET_REPO_PATTERN.test(repo) || repo.includes("..")) {
+            throw new Error(`Invalid Bitbucket repo "${repo}"; expected workspace/repo or PROJECT/repo.`);
+        }
+    }
+    return { repos };
+}
+export function createPendingCursorBitbucketCredentials() {
+    let getApiKey;
+    let transport;
+    return {
+        bind(next) {
+            getApiKey = next;
+        },
+        bindProxyTransport(next) {
+            transport = next;
+        },
+        getProxyTransport() {
+            if (getApiKey === undefined || transport === undefined) {
+                return undefined;
+            }
+            return Object.assign(Object.assign({}, transport), { getApiKey });
+        },
+    };
+}
+/** Bitbucket-proxy base URL (`/v0/bitbucket-proxy`, `AGENT_SERVE_BITBUCKET_PROXY_URL`). */
+export function resolveCursorBitbucketProxyUrl(backendBaseUrl) {
+    return resolveCursorScmProxyUrl("bitbucket", backendBaseUrl);
+}
+export function registerBitbucketCursorAccountRuntime(definition, runtime) {
+    runtimeByDefinition.set(definition, runtime);
+}
+export function getBitbucketCursorAccountRuntime(definition) {
+    return runtimeByDefinition.get(definition);
+}