@nitrostack/cli 1.0.12 → 1.0.13

package/dist/commands/cursor.d.ts

@@ -0,0 +1,11 @@
+interface CursorOptions {
+    global?: boolean;
+    local?: boolean;
+    type?: string;
+    url?: string;
+    port?: string;
+    force?: boolean;
+}
+export declare function cursorCommand(options: CursorOptions): Promise<void>;
+export {};
+//# sourceMappingURL=cursor.d.ts.map

package/dist/commands/cursor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor.d.ts","sourceRoot":"","sources":["../../src/commands/cursor.ts"],"names":[],"mappings":"AAqBA,UAAU,aAAa;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAuBD,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAoOzE"}

package/dist/commands/cursor.js

@@ -0,0 +1,238 @@
+import chalk from 'chalk';
+import path from 'path';
+import fs from 'fs-extra';
+import os from 'os';
+import inquirer from 'inquirer';
+import { createHeader, createSuccessBox, createErrorBox, NitroSpinner, log, spacer, nextSteps, showFooter, NITRO_BANNER_FULL } from '../ui/branding.js';
+import { trackEvent, shutdownAnalytics } from '../analytics/posthog.js';
+/** Normalize CLI --type values, including the deprecated `sse` alias. */
+function normalizeConnectionType(raw) {
+    if (!raw)
+        return undefined;
+    if (raw === 'sse')
+        return 'legacy-sse';
+    if (raw === 'command' || raw === 'legacy-sse' || raw === 'streamable-http') {
+        return raw;
+    }
+    return undefined;
+}
+function defaultHttpUrl(type, port) {
+    if (type === 'streamable-http') {
+        return `http://localhost:${port}/mcp`;
+    }
+    return `http://localhost:${port}/sse`;
+}
+function isHttpConnectionType(type) {
+    return type === 'legacy-sse' || type === 'streamable-http';
+}
+export async function cursorCommand(options) {
+    console.log(NITRO_BANNER_FULL);
+    console.log(createHeader('Cursor Integration', 'Configure MCP server in Cursor'));
+    const startTime = Date.now();
+    trackEvent('cli_command_invoked', {
+        command: 'cursor',
+        options: Object.keys(options).filter(k => options[k] !== undefined),
+    });
+    const projectRoot = process.cwd();
+    const packageJsonPath = path.join(projectRoot, 'package.json');
+    // Validate project
+    if (!fs.existsSync(packageJsonPath)) {
+        console.log(createErrorBox('Not a Valid Project', 'package.json not found in the current directory.'));
+        trackEvent('cli_cursor_failed', {
+            error: 'Not a valid project: package.json missing',
+        });
+        await shutdownAnalytics();
+        process.exit(1);
+    }
+    let packageJson;
+    try {
+        packageJson = await fs.readJson(packageJsonPath);
+    }
+    catch (error) {
+        console.log(createErrorBox('Invalid package.json', 'Could not parse project package.json.'));
+        trackEvent('cli_cursor_failed', {
+            error: 'Invalid package.json parsing error',
+        });
+        await shutdownAnalytics();
+        process.exit(1);
+    }
+    const rawName = packageJson.name || path.basename(projectRoot);
+    const serverName = rawName.includes('/') ? rawName.split('/').pop() : rawName;
+    let target;
+    if (options.global) {
+        target = 'global';
+    }
+    else if (options.local) {
+        target = 'local';
+    }
+    else {
+        const answers = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'target',
+                message: chalk.white('Where would you like to install the Cursor MCP configuration?'),
+                choices: [
+                    { name: `Project-level ${chalk.dim('(.cursor/mcp.json)')}`, value: 'local' },
+                    { name: `Global        ${chalk.dim('(~/.cursor/mcp.json)')}`, value: 'global' },
+                ],
+                default: 'local',
+            }
+        ]);
+        target = answers.target;
+    }
+    let type = normalizeConnectionType(options.type);
+    if (options.type && !type) {
+        console.log(createErrorBox('Invalid connection type', `Unknown --type "${options.type}". Use: command, legacy-sse, or streamable-http.`));
+        await shutdownAnalytics();
+        process.exit(1);
+    }
+    if (!type) {
+        const answers = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'type',
+                message: chalk.white('Choose the connection type for Cursor:'),
+                choices: [
+                    { name: `Command (Stdio)          ${chalk.dim('─ Starts subprocess (recommended for local dev)')}`, value: 'command' },
+                    { name: `Legacy SSE (/sse)        ${chalk.dim('─ Cursor and older HTTP clients (recommended for Cursor)')}`, value: 'legacy-sse' },
+                    { name: `Streamable HTTP (/mcp)   ${chalk.dim('─ MCP Inspector and modern Streamable HTTP clients')}`, value: 'streamable-http' },
+                ],
+                default: 'command',
+            }
+        ]);
+        type = answers.type;
+    }
+    if (!type) {
+        console.log(createErrorBox('Invalid connection type', 'No connection type selected.'));
+        await shutdownAnalytics();
+        process.exit(1);
+    }
+    const port = options.port || '3000';
+    let httpUrl = options.url;
+    if (isHttpConnectionType(type) && !httpUrl) {
+        const defaultUrl = defaultHttpUrl(type, port);
+        const urlHint = type === 'legacy-sse'
+            ? chalk.dim('Default /sse; /mcp also works for Cursor (legacy SSE fallback on GET).')
+            : chalk.dim('For MCP Inspector and clients that use POST initialize + mcp-session-id.');
+        const answers = await inquirer.prompt([
+            {
+                type: 'input',
+                name: 'url',
+                message: chalk.white('HTTP connection URL:'),
+                default: defaultUrl,
+            }
+        ]);
+        httpUrl = answers.url;
+        if (urlHint) {
+            console.log(urlHint);
+        }
+    }
+    let configFilePath;
+    if (target === 'global') {
+        configFilePath = path.join(os.homedir(), '.cursor', 'mcp.json');
+    }
+    else {
+        configFilePath = path.join(projectRoot, '.cursor', 'mcp.json');
+    }
+    let entry;
+    if (type === 'command') {
+        const absIndexPath = path.join(projectRoot, 'dist', 'index.js');
+        entry = {
+            command: 'node',
+            args: [absIndexPath],
+            env: {}
+        };
+    }
+    else {
+        entry = {
+            url: httpUrl
+        };
+    }
+    const spinner = new NitroSpinner(`Configuring Cursor MCP server...`).start();
+    try {
+        await fs.ensureDir(path.dirname(configFilePath));
+        let mcpConfig = { mcpServers: {} };
+        if (await fs.pathExists(configFilePath)) {
+            try {
+                mcpConfig = await fs.readJson(configFilePath);
+            }
+            catch (e) {
+                // Corrupted or empty file, initialize it
+                mcpConfig = { mcpServers: {} };
+            }
+        }
+        if (!mcpConfig.mcpServers) {
+            mcpConfig.mcpServers = {};
+        }
+        // Check if it already exists
+        if (mcpConfig.mcpServers[serverName] && !options.force) {
+            spinner.stop();
+            const { overwrite } = await inquirer.prompt([
+                {
+                    type: 'confirm',
+                    name: 'overwrite',
+                    message: chalk.yellow(`MCP Server "${serverName}" is already registered in Cursor config. Overwrite?`),
+                    default: true,
+                }
+            ]);
+            if (!overwrite) {
+                log('Cancelled integration', 'warning');
+                trackEvent('cli_cursor_cancelled', {
+                    server_name: serverName,
+                    target,
+                    type,
+                });
+                await shutdownAnalytics();
+                return;
+            }
+            spinner.start();
+        }
+        mcpConfig.mcpServers[serverName] = entry;
+        await fs.writeJson(configFilePath, mcpConfig, { spaces: 2 });
+        spinner.succeed(`Registered "${serverName}" in Cursor config`);
+    }
+    catch (err) {
+        spinner.fail('Failed to update Cursor configuration');
+        console.log(createErrorBox('Integration Failed', err instanceof Error ? err.message : String(err)));
+        trackEvent('cli_cursor_failed', {
+            error: err instanceof Error ? err.message : String(err),
+            target,
+            type,
+        });
+        await shutdownAnalytics();
+        return;
+    }
+    // Summary
+    spacer();
+    console.log(createSuccessBox('Cursor Integration Successful', [
+        `Configured target: ${chalk.cyan(configFilePath)}`,
+        `Server registered: ${chalk.cyan(serverName)}`,
+        `Connection type:   ${chalk.cyan(type)}`,
+        type === 'command'
+            ? `Command path:      ${chalk.dim(path.join(projectRoot, 'dist', 'index.js'))}`
+            : `HTTP URL:          ${chalk.cyan(httpUrl)}`
+    ]));
+    if (type === 'command') {
+        // Check if dist/index.js exists
+        const distIndexPath = path.join(projectRoot, 'dist', 'index.js');
+        if (!fs.existsSync(distIndexPath)) {
+            log('Warning: dist/index.js not found. Remember to run "npm run build" first!', 'warning');
+            spacer();
+        }
+    }
+    if (type === 'legacy-sse') {
+        log('Tip: ensure the server is running in dual or http mode before connecting from Cursor.', 'info');
+    }
+    nextSteps([
+        'Restart/Reload your Cursor window to load the new MCP server',
+        'Check active MCP servers in Cursor under Settings > Tools > MCP',
+    ]);
+    showFooter();
+    trackEvent('cli_cursor_completed', {
+        target,
+        type,
+        server_name: serverName,
+        duration_ms: Date.now() - startTime,
+    });
+    await shutdownAnalytics();
+}

package/dist/commands/upgrade.d.ts

@@ -2,6 +2,18 @@ interface UpgradeOptions {
     latest?: boolean;
     dryRun?: boolean;
 }
+/**
+ * Fetch a package's latest published version from NPM using standard https module.
+ */
+export declare function fetchLatestNpmVersion(packageName: string): Promise<string>;
+/**
+ * Compare two version strings
+ */
+export declare function compareVersions(v1: string, v2: string): number;
+/**
+ * Determine if a dependency refers to a local file or workspace link.
+ */
+export declare function isLocalDependency(version: string): boolean;
 /**
  * Main upgrade command handler
  */

package/dist/commands/upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AA0BA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAwHD;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA2J3E"}
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/commands/upgrade.ts"],"names":[],"mappings":"AA2BA,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAUD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgD1E;AA2BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAa9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAqED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsI3E"}

package/dist/commands/upgrade.js

@@ -2,22 +2,57 @@ import chalk from 'chalk';
 import { execSync } from 'child_process';
 import path from 'path';
 import fs from 'fs-extra';
+import https from 'https';
 import { createHeader, createBox, createSuccessBox, createErrorBox, NitroSpinner, log, spacer, nextSteps, NITRO_BANNER_FULL, showFooter } from '../ui/branding.js';
 import { trackEvent, shutdownAnalytics } from '../analytics/posthog.js';
 /**
- * Get the latest version of a package from npm registry
+ * Fetch a package's latest published version from NPM using standard https module.
  */
-function getLatestVersion(packageName = '@nitrostack/core') {
-    try {
-        const result = execSync(`npm view ${packageName} version`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return result;
-    }
-    catch {
-        throw new Error(`Failed to fetch latest version for ${packageName} from npm`);
-    }
+export function fetchLatestNpmVersion(packageName) {
+    return new Promise((resolve, reject) => {
+        const url = `https://registry.npmjs.org/${packageName}/latest`;
+        const req = https.get(url, {
+            headers: {
+                'Accept': 'application/json',
+                'User-Agent': 'nitrostack-cli-upgrade'
+            },
+            timeout: 5000
+        }, (res) => {
+            if (res.statusCode !== 200) {
+                reject(new Error(`Registry responded with HTTP ${res.statusCode}`));
+                return;
+            }
+            let data = '';
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            // Handle stream errors
+            res.on('error', (err) => {
+                reject(new Error(`Response stream error: ${err.message}`));
+            });
+            res.on('end', () => {
+                try {
+                    const parsed = JSON.parse(data);
+                    if (parsed.version) {
+                        resolve(parsed.version);
+                    }
+                    else {
+                        reject(new Error('Invalid response structure from NPM registry'));
+                    }
+                }
+                catch (e) {
+                    reject(new Error(`Failed to parse response: ${e.message}`));
+                }
+            });
+        });
+        req.on('error', (err) => {
+            reject(err);
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            reject(new Error('Request timed out'));
+        });
+    });
 }
 /**
  * Get the current installed version of @nitrostack/core from package.json
@@ -32,15 +67,19 @@ function getCoreVersion(packageJsonPath) {
         null;
 }
 /**
- * Parse version string to extract the actual version number
+ * Parse version string to extract the actual numeric version.
+ *
+ * Strips any leading range operator (^ ~ >= <= > <) and drops the pre-release
+ * suffix (e.g. `-beta.1`) so the dot-separated segments always parse to numbers
+ * instead of producing `NaN` in `compareVersions`.
  */
 function parseVersion(versionString) {
-    return versionString.replace(/^[\^~>=<]+/, '');
+    return versionString.replace(/^[\^~>=<]+/, '').split('-')[0];
 }
 /**
  * Compare two version strings
  */
-function compareVersions(v1, v2) {
+export function compareVersions(v1, v2) {
     const parts1 = parseVersion(v1).split('.').map(Number);
     const parts2 = parseVersion(v2).split('.').map(Number);
     for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
@@ -54,37 +93,58 @@ function compareVersions(v1, v2) {
     return 0;
 }
 /**
- * Update all @nitrostack/* versions in package.json
+ * Determine if a dependency refers to a local file or workspace link.
  */
-function updatePackageJson(packageJsonPath, newVersion, dryRun) {
+export function isLocalDependency(version) {
+    return version.startsWith('file:') ||
+        version.startsWith('link:') ||
+        version.startsWith('workspace:') ||
+        version.startsWith('.') ||
+        version.startsWith('/');
+}
+/**
+ * Update all @nitrostack/* versions in package.json using dynamic npm registry fetch
+ */
+async function updatePackageJson(packageJsonPath, dryRun) {
     if (!fs.existsSync(packageJsonPath)) {
         return [];
     }
     const packageJson = fs.readJSONSync(packageJsonPath);
     const results = [];
     let hasChanges = false;
-    const updateDeps = (deps) => {
+    const updateDeps = async (deps) => {
         if (!deps)
             return;
-        for (const pkg of Object.keys(deps)) {
+        const promises = Object.keys(deps).map(async (pkg) => {
             if (pkg.startsWith('@nitrostack/')) {
                 const currentVersion = deps[pkg];
-                if (compareVersions(currentVersion, newVersion) < 0) {
-                    results.push({
-                        location: path.basename(path.dirname(packageJsonPath)),
-                        packageName: pkg,
-                        previousVersion: currentVersion,
-                        newVersion: `^${newVersion}`,
-                        upgraded: true,
-                    });
-                    deps[pkg] = `^${newVersion}`;
-                    hasChanges = true;
+                // Skip local dependencies entirely
+                if (isLocalDependency(currentVersion)) {
+                    return;
+                }
+                try {
+                    const latestVersion = await fetchLatestNpmVersion(pkg);
+                    if (compareVersions(currentVersion, latestVersion) < 0) {
+                        results.push({
+                            location: path.basename(path.dirname(packageJsonPath)),
+                            packageName: pkg,
+                            previousVersion: currentVersion,
+                            newVersion: `^${latestVersion}`,
+                            upgraded: true,
+                        });
+                        deps[pkg] = `^${latestVersion}`;
+                        hasChanges = true;
+                    }
+                }
+                catch (error) {
+                    console.warn(`\n⚠️  Skipped upgrade check for ${pkg}: ${error.message}`);
                 }
             }
-        }
+        });
+        await Promise.all(promises);
     };
-    updateDeps(packageJson.dependencies);
-    updateDeps(packageJson.devDependencies);
+    await updateDeps(packageJson.dependencies);
+    await updateDeps(packageJson.devDependencies);
     if (hasChanges && !dryRun) {
         fs.writeJSONSync(packageJsonPath, packageJson, { spaces: 2 });
     }
@@ -123,51 +183,22 @@ export async function upgradeCommand(options) {
         console.log(createErrorBox('Not a NitroStack Project', '@nitrostack/core is not a dependency'));
         process.exit(1);
     }
-    // Fetch latest version
-    const spinner = new NitroSpinner('Checking for updates...').start();
-    let latestVersion;
-    try {
-        latestVersion = getLatestVersion('@nitrostack/core');
-        spinner.succeed(`Latest version: ${chalk.cyan(latestVersion)}`);
-    }
-    catch (error) {
-        spinner.fail('Failed to fetch latest version');
-        process.exit(1);
-    }
-    // Check if already on latest
-    const currentParsedVersion = parseVersion(coreVersion);
-    if (compareVersions(currentParsedVersion, latestVersion) >= 0) {
-        spacer();
-        console.log(createSuccessBox('Already Up to Date', [
-            `Current version: ${currentParsedVersion}`,
-            `Latest version:  ${latestVersion}`,
-        ]));
-        trackEvent('cli_upgrade_completed', {
-            packages_upgraded: 0,
-            from_version: currentParsedVersion,
-            to_version: latestVersion,
-            dry_run: !!options.dryRun,
-            already_current: true,
-        });
-        await shutdownAnalytics();
-        return;
-    }
-    const allResults = [];
     const dryRun = options.dryRun ?? false;
     if (dryRun) {
         spacer();
         log('Dry run mode - no changes will be made', 'warning');
     }
     spacer();
-    log('Upgrading dependencies...', 'info');
+    log('Checking for package updates...', 'info');
     spacer();
+    const allResults = [];
     // Upgrade root
-    const rootSpinner = new NitroSpinner('Updating root package.json...').start();
+    const rootSpinner = new NitroSpinner('Checking root package.json...').start();
     try {
-        const results = updatePackageJson(rootPackageJsonPath, latestVersion, dryRun);
+        const results = await updatePackageJson(rootPackageJsonPath, dryRun);
         if (results.length > 0) {
             allResults.push(...results);
-            rootSpinner.succeed(`Root: Updated ${results.length} @nitrostack packages`);
+            rootSpinner.succeed(`Root: Found ${results.length} package update(s)`);
             if (!dryRun) {
                 const installSpinner = new NitroSpinner('Installing dependencies...').start();
                 runNpmInstall(projectRoot);
@@ -175,7 +206,7 @@ export async function upgradeCommand(options) {
             }
         }
         else {
-            rootSpinner.info('Root: All @nitrostack packages are up to date');
+            rootSpinner.info('Root: All @nitrostack packages are up to date (or local references)');
         }
     }
     catch (error) {
@@ -184,12 +215,12 @@ export async function upgradeCommand(options) {
     }
     // Upgrade widgets if they exist
     if (fs.existsSync(widgetsPackageJsonPath)) {
-        const widgetsSpinner = new NitroSpinner('Updating widgets package.json...').start();
+        const widgetsSpinner = new NitroSpinner('Checking widgets package.json...').start();
         try {
-            const results = updatePackageJson(widgetsPackageJsonPath, latestVersion, dryRun);
+            const results = await updatePackageJson(widgetsPackageJsonPath, dryRun);
             if (results.length > 0) {
                 allResults.push(...results);
-                widgetsSpinner.succeed(`Widgets: Updated ${results.length} @nitrostack packages`);
+                widgetsSpinner.succeed(`Widgets: Found ${results.length} package update(s)`);
                 if (!dryRun) {
                     const installSpinner = new NitroSpinner('Installing widget dependencies...').start();
                     runNpmInstall(widgetsPath);
@@ -197,54 +228,61 @@ export async function upgradeCommand(options) {
                 }
             }
             else {
-                widgetsSpinner.info('Widgets: All @nitrostack packages are up to date');
+                widgetsSpinner.info('Widgets: All @nitrostack packages are up to date (or local references)');
             }
         }
         catch (error) {
             widgetsSpinner.fail('Failed to upgrade widgets');
+            console.error(error);
         }
     }
     // Summary
     spacer();
     if (allResults.length === 0) {
-        log('No packages were upgraded', 'warning');
-    }
-    else {
-        // Unique packages upgraded
-        const uniquePackages = Array.from(new Set(allResults.map(r => r.packageName)));
-        const summaryItems = uniquePackages.map(pkg => {
-            const result = allResults.find(r => r.packageName === pkg);
-            return `${pkg}: ${parseVersion(result.previousVersion)} → ${parseVersion(result.newVersion)}`;
-        });
-        if (dryRun) {
-            spacer();
-            console.log(createBox([
-                chalk.yellow.bold('Dry run complete'),
-                '',
-                chalk.dim('No changes were made to your project.'),
-                chalk.dim('Run without --dry-run to apply the upgrade.'),
-            ], 'warning'));
-        }
-        else {
-            console.log(createSuccessBox('Upgrade Complete', [
-                ...summaryItems,
-                '',
-                chalk.dim(`Total updates across all packages: ${allResults.length}`)
-            ]));
-            nextSteps([
-                'Review the changes in package.json',
-                'Restart your development server',
-                'Check docs.nitrostack.ai for migration guides',
-            ]);
-        }
-        showFooter();
+        console.log(createSuccessBox('Already Up to Date', [
+            'All @nitrostack packages are already running their latest versions.',
+        ]));
         trackEvent('cli_upgrade_completed', {
-            packages_upgraded: allResults.length,
-            from_version: currentParsedVersion,
-            to_version: latestVersion,
+            packages_upgraded: 0,
             dry_run: dryRun,
-            already_current: false,
+            already_current: true,
         });
         await shutdownAnalytics();
+        return;
     }
+    // Unique packages upgraded
+    const uniquePackages = Array.from(new Set(allResults.map(r => r.packageName)));
+    const summaryItems = uniquePackages.map(pkg => {
+        const result = allResults.find(r => r.packageName === pkg);
+        return `${pkg}: ${parseVersion(result.previousVersion)} → ${parseVersion(result.newVersion)}`;
+    });
+    if (dryRun) {
+        spacer();
+        console.log(createBox([
+            chalk.yellow.bold('Dry Run - Proposed Upgrades:'),
+            ...summaryItems.map(item => `  • ${item}`),
+            '',
+            chalk.dim('No changes were made to your project.'),
+            chalk.dim('Run without --dry-run to apply the upgrade.'),
+        ], 'warning'));
+    }
+    else {
+        console.log(createSuccessBox('Upgrade Complete', [
+            ...summaryItems,
+            '',
+            chalk.dim(`Total updates across all packages: ${allResults.length}`)
+        ]));
+        nextSteps([
+            'Review the changes in package.json',
+            'Restart your development server',
+            'Check docs.nitrostack.ai for migration guides',
+        ]);
+    }
+    showFooter();
+    trackEvent('cli_upgrade_completed', {
+        packages_upgraded: allResults.length,
+        dry_run: dryRun,
+        already_current: false,
+    });
+    await shutdownAnalytics();
 }

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export { startCommand } from './commands/start.js';
 export { generate } from './commands/generate.js';
 export { upgradeCommand } from './commands/upgrade.js';
 export { installCommand } from './commands/install.js';
+export { cursorCommand } from './commands/cursor.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,wBAAgB,aAAa,YAgE5B;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,aAAa,YA4E5B;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -8,6 +8,7 @@ import { startCommand } from './commands/start.js';
 import { generate } from './commands/generate.js';
 import { upgradeCommand } from './commands/upgrade.js';
 import { installCommand } from './commands/install.js';
+import { cursorCommand } from './commands/cursor.js';
 const require = createRequire(import.meta.url);
 const packageJson = require('../package.json');
 export function createProgram() {
@@ -64,6 +65,17 @@ export function createProgram() {
         .option('--skip-widgets', 'Skip installing widget dependencies')
         .option('--production', 'Install production dependencies only')
         .action(installCommand);
+    program
+        .command('cursor')
+        .alias('c')
+        .description('Integrate this MCP server with Cursor')
+        .option('-g, --global', 'Install globally to ~/.cursor/mcp.json')
+        .option('-l, --local', 'Install locally to .cursor/mcp.json')
+        .option('-t, --type <type>', 'Connection type: "command", "legacy-sse", or "streamable-http" (alias: "sse" → legacy-sse)')
+        .option('-u, --url <url>', 'HTTP connection URL (for legacy-sse or streamable-http)')
+        .option('-p, --port <port>', 'Port for default HTTP URL (for legacy-sse or streamable-http)')
+        .option('--force', 'Force overwrite of existing configuration')
+        .action(cursorCommand);
     return program;
 }
 // Re-export commands for programmatic use
@@ -74,6 +86,7 @@ export { startCommand } from './commands/start.js';
 export { generate } from './commands/generate.js';
 export { upgradeCommand } from './commands/upgrade.js';
 export { installCommand } from './commands/install.js';
+export { cursorCommand } from './commands/cursor.js';
 // Run the CLI when this module is the entry point
 import { fileURLToPath } from 'url';
 import { realpathSync } from 'fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitrostack/cli",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "description": "CLI for NitroStack - Create and manage MCP server projects",
   "type": "module",
   "main": "dist/index.js",
@@ -11,9 +11,9 @@
   },
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "require": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "require": "./dist/index.js"
     }
   },
   "files": [

package/templates/typescript-oauth/.env.example

@@ -2,30 +2,87 @@
 NITRO_LOG_LEVEL=info
 NITROSTACK_APP_MODE=openai
 
-# OAuth 2.1 MCP Server Configuration
+# Server Transport Configuration (Optional)
 # =============================================================================
-# TRANSPORT MODE (AUTO-CONFIGURED)
+# MCP_TRANSPORT_TYPE: Toggles transport mode. Values: stdio | http | dual.
+# Defaults to 'stdio' in development and 'dual' in production/NODE_ENV=production.
 # =============================================================================
-# When OAuth is configured, the server automatically runs in DUAL mode:
-# - STDIO: For MCP proto¯col communication with Studio/Claude
-# - HTTP: For OAuth metadata endpoints (/.well-known/oauth-protected-resource)
-# Both transports run simultaneously on different channels.
+# MCP_TRANSPORT_TYPE=dual
+# PORT=3000
+# HOST=localhost
+# ENABLE_CORS=true
+
+# Streamable HTTP Session Limits (Optional)
 # =============================================================================
-# REQUIRED: Server Configuration
+# Bounds memory against unauthenticated initialize floods. Defaults: 1000 sessions,
+# 30-minute idle timeout. Only applies when running in http or dual transport mode.
 # =============================================================================
+# MCP_MAX_SESSIONS=1000
+# MCP_SESSION_TIMEOUT_MS=1800000
+
+# OAuth 2.1 MCP Server Configuration
+# =============================================================================
+# Enforcement Gate (Optional)
 # =============================================================================
-# Auth0 Configuration
+# OAUTH_REQUIRED controls whether authentication is enforced.
+#   - Unset / false (default): auth is NOT enforced. The server runs out-of-the-box
+#     and protected endpoints are reachable without a token. Best for local dev.
+#   - true: auth is enforced (fail-closed). If neither JWKS_URI nor
+#     INTROSPECTION_ENDPOINT is configured, the server STILL starts and logs a
+#     clear warning, but rejects all protected requests until a verifier is set.
+# Set this to true (and configure a verifier below) before deploying.
+# =============================================================================
+# OAUTH_REQUIRED=true
+
+# =============================================================================
+# REQUIRED: Server Configuration
 # =============================================================================
-# After creating your API and Application in Auth0, fill in these values:
 # Your Auth0 API Identifier (from APIs → MCP Server → Identifier)
 # This MUST match exactly what you set when creating the API
-# This MUST match exactly what you set when creating the API
 RESOURCE_URI=https://mcplocal
-# Your Auth0 tenant domain (authorization server)
+
+# Your Auth0 tenant domain (authorization server URL)
 AUTH_SERVER_URL=https://dev-5dt0utuk315713tjm.us.auth0.com
-# Expected token audience (should match RESOURCE_URI)
+
+# Cryptographic JWKS Signature Verification (Recommended)
+# =============================================================================
+# If configured, the SDK cryptographically verifies token signatures using JWKS keys.
+# Token validation is SECURE BY DEFAULT (fail-closed): if neither JWKS_URI nor an
+# introspection endpoint (below) is configured, ALL tokens are rejected. Configure
+# one of them for a working server.
+# NOTE: Unsigned/signature-less token decoding is disabled by default and is only
+# available via the in-code `allowInsecureTokenDecode: true` option in
+# OAuthModule.forRoot(...) — intended for local development only, never production.
+# =============================================================================
+# JWKS_URI=https://dev-5dt0utuk315713tjm.us.auth0.com/.well-known/jwks.json
+
+# Expected token validation audience (should match RESOURCE_URI)
 TOKEN_AUDIENCE=https://mcplocal
-# Expected token issuer (your Auth0 tenant domain with trailing slash)
+
+# Expected token validation issuer (your authorization server tenant domain)
 TOKEN_ISSUER=https://dev-5dt0utuk315713tjm.us.auth0.com
 
-DUFFEL_API_KEY=your-duffel-api-key
+# Token Introspection Configuration (Alternative to JWKS signature verification)
+# =============================================================================
+# INTROSPECTION_ENDPOINT=https://dev-5dt0utuk315713tjm.us.auth0.com/oauth/introspect
+# INTROSPECTION_CLIENT_ID=your-introspection-client-id
+# INTROSPECTION_CLIENT_SECRET=your-introspection-client-secret
+
+# OAuth Discovery Settings (Optional)
+# =============================================================================
+# OAUTH_DISCOVERY_PORT=3005
+# OAUTH_DISCOVERY_AUTO_RETRY=true
+# MCP_SERVER_PORT=3000
+
+# Dynamic Client Registration (Optional / disabled by default)
+# =============================================================================
+# Set to 'true' to expose the /oauth/v2/register endpoint. It only serves the
+# statically configured client below; without OAUTH_CLIENT_ID it stays disabled.
+# =============================================================================
+# OAUTH_ENABLE_CLIENT_REGISTRATION=true
+# OAUTH_CLIENT_ID=your-client-id
+# OAUTH_CLIENT_SECRET=your-client-secret
+
+# Duffel API Integration (Required for Flight Search & Booking)
+# =============================================================================
+DUFFEL_API_KEY=your-duffel-api-key

package/templates/typescript-oauth/src/app.module.ts

@@ -36,6 +36,13 @@ import { SystemHealthCheck } from './health/system.health.js';
 
     // Enable OAuth 2.1 authentication
     OAuthModule.forRoot({
+      // Whether OAuth is enforced. Defaults to false (dev-friendly): the server
+      // runs out-of-the-box and protected endpoints are reachable without a token.
+      // Set OAUTH_REQUIRED=true to enforce auth (fail-closed). When enforced but no
+      // verifier (JWKS_URI / INTROSPECTION_ENDPOINT) is configured, the server still
+      // starts and warns, but rejects protected requests until one is configured.
+      required: process.env.OAUTH_REQUIRED === 'true',
+
       // Resource URI - YOUR MCP server's public URL
       // This is used for token audience binding (RFC 8707)
       // CRITICAL: Tokens must be issued specifically for this URI

package/templates/typescript-oauth/src/guards/oauth.guard.ts

@@ -41,6 +41,25 @@ export class OAuthGuard implements Guard {
     } else if (metaToken) {
       token = metaToken as string;
     }
+
+    // Enforcement gate: when OAuth is not required (OAUTH_REQUIRED not "true"),
+    // do not reject. Best-effort: if a valid token happens to be present, attach
+    // its identity; otherwise allow the request through unauthenticated.
+    if (!OAuthModule.isAuthRequired()) {
+      if (token) {
+        const result = await OAuthModule.validateToken(token);
+        if (result.valid) {
+          const payload = result.payload as OAuthTokenPayload;
+          context.auth = {
+            subject: payload.sub,
+            scopes: this.extractScopes(payload),
+            clientId: payload.client_id,
+            tokenPayload: payload,
+          };
+        }
+      }
+      return true;
+    }
     
     if (!token) {
       throw new Error(

package/templates/typescript-oauth/src/index.ts

@@ -28,26 +28,24 @@ async function bootstrap() {
   try {
     console.error('🔐 Starting Calculator MCP Server with OAuth 2.1...\\n');
 
-    // Validate required environment variables for OAuth
-    const requiredEnvVars = ['RESOURCE_URI', 'AUTH_SERVER_URL'];
-    const missing = requiredEnvVars.filter(v => !process.env[v]);
-
-    if (missing.length > 0) {
-      console.error('❌ Missing required OAuth environment variables:');
-      missing.forEach(v => console.error(`   - ${v}`));
-      console.error('\\n💡 Copy .env.example to .env and configure your OAuth provider');
-      console.error('   Or check the test-oauth/.env for reference\\n');
-      process.exit(1);
+    // Validate required environment variables for OAuth, set defaults if missing
+    if (!process.env.RESOURCE_URI || !process.env.AUTH_SERVER_URL) {
+      console.error('⚠️  Warning: Missing RESOURCE_URI or AUTH_SERVER_URL environment variables.');
+      console.error('   Defaulting to local test endpoints. Copy .env.example to .env to configure.\n');
+      process.env.RESOURCE_URI = process.env.RESOURCE_URI || 'http://localhost:3000';
+      process.env.AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || 'http://localhost:8080/auth';
     }
 
     // Create the MCP application
     const server = await McpApplicationFactory.create(AppModule);
 
+    const authEnforced = process.env.OAUTH_REQUIRED === 'true';
     console.error('✅ OAuth 2.1 Module configured');
     console.error(`   Resource URI: ${process.env.RESOURCE_URI}`);
     console.error(`   Auth Server: ${process.env.AUTH_SERVER_URL}`);
     console.error(`   Scopes: read, write, admin`);
-    console.error(`   Audience: ${process.env.TOKEN_AUDIENCE || process.env.RESOURCE_URI}\\n`);
+    console.error(`   Audience: ${process.env.TOKEN_AUDIENCE || process.env.RESOURCE_URI}`);
+    console.error(`   Enforcement: ${authEnforced ? 'ON (OAUTH_REQUIRED=true)' : 'OFF (dev mode — set OAUTH_REQUIRED=true to enforce)'}\\n`);
 
     // Start the server
     await server.start();

package/templates/typescript-oauth/src/modules/flights/flights.prompts.ts

@@ -79,8 +79,26 @@ Respond to EXACTLY what the user asked - nothing more.`;
         ]
     })
     async flightComparison(input: any, ctx: ExecutionContext) {
+        let ids: string[] = [];
+        if (Array.isArray(input.offerIds)) {
+            ids = input.offerIds;
+        } else if (typeof input.offerIds === 'string') {
+            const trimmed = input.offerIds.trim();
+            if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+                try {
+                    const parsed = JSON.parse(trimmed);
+                    ids = Array.isArray(parsed) ? parsed : [parsed];
+                } catch {
+                    ids = trimmed.split(',').map((s: string) => s.trim());
+                }
+            } else {
+                ids = trimmed.split(',').map((s: string) => s.trim());
+            }
+        }
+        ids = ids.filter(Boolean);
+
         const offers = await Promise.all(
-            input.offerIds.map((id: string) => this.duffelService.getOffer(id))
+            ids.map((id: string) => this.duffelService.getOffer(id))
         );
 
         const comparisonData = offers.map((offer: any) => {

package/templates/typescript-oauth/src/services/duffel.service.ts

@@ -12,9 +12,11 @@ export class DuffelService {
     private duffel: Duffel;
 
     constructor() {
-        const apiKey = process.env.DUFFEL_API_KEY;
+        let apiKey = process.env.DUFFEL_API_KEY;
         if (!apiKey) {
-            throw new Error('DUFFEL_API_KEY environment variable is required');
+            console.error('⚠️  Warning: DUFFEL_API_KEY environment variable is missing.');
+            console.error('   Running with a dummy key for testing/dry-run mode.\n');
+            apiKey = 'duffel_test_dummy_key';
         }
 
         this.duffel = new Duffel({

package/templates/typescript-pizzaz/.env.example

@@ -2,6 +2,16 @@
 NITRO_LOG_LEVEL=info
 NITROSTACK_APP_MODE=openai
 
+# Server Transport Configuration (Optional)
+# =============================================================================
+# MCP_TRANSPORT_TYPE: Toggles transport mode. Values: stdio | http | dual.
+# Defaults to 'stdio' in development and 'dual' in production/NODE_ENV=production.
+# =============================================================================
+# MCP_TRANSPORT_TYPE=stdio
+# PORT=3000
+# HOST=localhost
+# ENABLE_CORS=true
+
 # Mapbox Configuration (Optional)
 # =============================================================================
 # The map widget uses Mapbox GL for interactive maps. 

package/templates/typescript-starter/.env.example

@@ -1,3 +1,13 @@
 # NitroStack Configuration
 NITRO_LOG_LEVEL=info
 NITROSTACK_APP_MODE=openai
+
+# Server Transport Configuration (Optional)
+# =============================================================================
+# MCP_TRANSPORT_TYPE: Toggles transport mode. Values: stdio | http | dual.
+# Defaults to 'stdio' in development and 'dual' in production/NODE_ENV=production.
+# =============================================================================
+# MCP_TRANSPORT_TYPE=stdio
+# PORT=3000
+# HOST=localhost
+# ENABLE_CORS=true