@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/{cursor-_gHHq-Dq.mjs → cursor-CF1iHHbv.mjs}

@@ -1,11 +1,15 @@
 import { installBunShim as __installBunShim } from "./bun-shim.mjs";
 __installBunShim();
-import { r as __exportAll } from "./fs-promises-shim-B2YFWkcd.mjs";
-import { f as OAuthError } from "./error-O63pC8zg.mjs";
-import { t as generatePKCE } from "./pkce-BYjmugmw.mjs";
-//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.1.17/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/cursor.ts
+import { i as __exportAll } from "./fs-promises-shim-CANAxFWh.mjs";
+import { X as ProviderHttpError, h as OAuthError } from "./error-8LVo7tug.mjs";
+import "./utils-C_Ncya1r.mjs";
+import { h as isRecord } from "./cascade-BWjRTD1q.mjs";
+import { t as generatePKCE } from "./pkce-DO-jBJLV.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/cursor.ts
 var cursor_exports = /* @__PURE__ */ __exportAll({
+	cursorSessionHeaders: () => cursorSessionHeaders,
 	extractCursorAccessTokenUserId: () => extractCursorAccessTokenUserId,
+	fetchCursorAccountEmail: () => fetchCursorAccountEmail,
 	generateCursorAuthParams: () => generateCursorAuthParams,
 	loginCursor: () => loginCursor,
 	loginCursorHook: () => loginCursorHook,
@@ -15,7 +19,11 @@ var cursor_exports = /* @__PURE__ */ __exportAll({
 });
 const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
 const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
-const CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
+const CURSOR_REFRESH_URL = "https://api2.cursor.sh/oauth/token";
+/** OAuth client the Cursor IDE renews its login session with. */
+const CURSOR_CLIENT_ID = "KbZUR41cY7W6zRSdpSUJ7I7mLYBKOCmB";
+const CURSOR_PROFILE_URL = "https://cursor.com/api/auth/me";
+const CURSOR_PROFILE_TIMEOUT_MS = 3e3;
 const POLL_MAX_ATTEMPTS = 150;
 const POLL_BASE_DELAY = 1e3;
 const POLL_MAX_DELAY = 1e4;
@@ -85,16 +93,17 @@ async function loginCursor(onAuthUrl, onPollStart) {
 	};
 }
 async function loginCursorHook(callbacks) {
-	return loginCursor((url) => callbacks.onAuth?.({ url }), callbacks.onProgress ? () => callbacks.onProgress?.("Waiting for browser authentication...") : void 0);
+	return withCursorAccountEmail(await loginCursor((url) => callbacks.onAuth?.({ url }), callbacks.onProgress ? () => callbacks.onProgress?.("Waiting for browser authentication...") : void 0), callbacks.fetch ?? fetch, callbacks.signal);
 }
-async function refreshCursorToken(apiKeyOrRefreshToken) {
+async function refreshCursorToken(refreshToken) {
 	const response = await fetch(CURSOR_REFRESH_URL, {
 		method: "POST",
-		headers: {
-			Authorization: `Bearer ${apiKeyOrRefreshToken}`,
-			"Content-Type": "application/json"
-		},
-		body: "{}"
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			grant_type: "refresh_token",
+			client_id: CURSOR_CLIENT_ID,
+			refresh_token: refreshToken
+		})
 	});
 	if (!response.ok) {
 		const error = await response.text();
@@ -104,15 +113,55 @@ async function refreshCursorToken(apiKeyOrRefreshToken) {
 		});
 	}
 	const data = await response.json();
-	const expiresAt = getTokenExpiry(data.accessToken);
+	if (data.shouldLogout === true) throw new OAuthError("invalid_grant: Cursor ended this session; run /login cursor again", {
+		kind: "token-refresh",
+		provider: "cursor"
+	});
+	if (!data.access_token) throw new OAuthError("Cursor token refresh returned no access token", {
+		kind: "token-refresh",
+		provider: "cursor"
+	});
+	return {
+		access: data.access_token,
+		refresh: data.refresh_token || refreshToken,
+		expires: getTokenExpiry(data.access_token)
+	};
+}
+async function refreshCursorHook(credentials, signal) {
+	const refreshed = await refreshCursorToken(credentials.refresh);
+	return credentials.email ? refreshed : withCursorAccountEmail(refreshed, fetch, signal);
+}
+/** Request headers that present `accessToken` to cursor.com as its user's web session. */
+function cursorSessionHeaders(userId, accessToken) {
 	return {
-		access: data.accessToken,
-		refresh: data.refreshToken || apiKeyOrRefreshToken,
-		expires: expiresAt
+		Accept: "application/json",
+		Cookie: `WorkosCursorSessionToken=${encodeURIComponent(`${userId}::${accessToken}`)}`
 	};
 }
-async function refreshCursorHook(credentials) {
-	return refreshCursorToken(credentials.refresh);
+/**
+* Email of the Cursor account that owns `accessToken`, read from its cursor.com
+* profile. Undefined when the token names no user or the profile names another.
+*/
+async function fetchCursorAccountEmail(accessToken, fetchImpl = fetch, signal) {
+	const userId = extractCursorAccessTokenUserId(accessToken);
+	if (!userId) return void 0;
+	const response = await fetchImpl(CURSOR_PROFILE_URL, {
+		headers: cursorSessionHeaders(userId, accessToken),
+		signal
+	});
+	if (!response.ok) throw new ProviderHttpError(`Cursor profile request failed: ${response.status}`, response.status);
+	const payload = await response.json();
+	if (!isRecord(payload) || payload.sub !== userId || typeof payload.email !== "string") return void 0;
+	return payload.email.trim() || void 0;
+}
+/** Attach the account email so account policies and pickers can name this login; a failed lookup leaves it off. */
+async function withCursorAccountEmail(credentials, fetchImpl, signal) {
+	const timeout = AbortSignal.timeout(CURSOR_PROFILE_TIMEOUT_MS);
+	const email = await fetchCursorAccountEmail(credentials.access, fetchImpl, signal ? AbortSignal.any([signal, timeout]) : timeout).catch(() => void 0);
+	return email ? {
+		...credentials,
+		email
+	} : credentials;
 }
 function decodeCursorAccessTokenPayload(token) {
 	const parts = token.split(".");
@@ -140,4 +189,4 @@ function getTokenExpiry(token) {
 	return Date.now() + 36e5;
 }
 //#endregion
-export { extractCursorAccessTokenUserId as n, cursor_exports as t };
+export { fetchCursorAccountEmail as i, cursor_exports as n, extractCursorAccessTokenUserId as r, cursorSessionHeaders as t };