@cursor/july 0.1.114 → 0.2.1

package/dist/index.d.ts

@@ -37,7 +37,7 @@ export { agentStoreMemoryBackend, fileMemoryBackend, memoryHook, } from "./memor
 export type { OtelConfig, OtelDefinition, OtelExporterConfig } from "./otel.js";
 export type { PromptTag } from "./prompt.js";
 export { prompt } from "./prompt.js";
-export type { ReminderBusyPolicy, ReminderCreateInput, ReminderDefinition, ReminderFireContext, ReminderFireResult, ReminderHandlerConfig, ReminderHostApi, ReminderInfo, ReminderReschedule, ReminderScheduleKind, ReminderStatus, ReminderTarget, ReminderUntilContext, } from "./reminders.js";
+export type { ReminderBusyPolicy, ReminderCreateInput, ReminderDefinition, ReminderFireContext, ReminderFireResult, ReminderFollowupOptions, ReminderHandlerConfig, ReminderHostApi, ReminderInfo, ReminderReschedule, ReminderScheduleKind, ReminderStatus, ReminderTarget, ReminderUntilContext, } from "./reminders.js";
 export { defineReminder } from "./reminders.js";
 export { defineResult } from "./result.js";
 export { defineSchedule } from "./schedules.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,GAAG,EACH,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,GAAG,EACH,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,SAAS,EACT,OAAO,EACP,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,EACN,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,MAAM,EACN,OAAO,EACP,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAChF,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,aAAa,EACb,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,EAC7B,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,qBAAqB,CAEtE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,YAAY,EAAE,MAAM,GAAG,YAAY,EACnC,OAAO,GAAE,YAAY,GAAG;IACtB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAqB3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,GAAG,EACH,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,GAAG,EACH,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,OAAO,EACP,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,QAAQ,EACR,SAAS,EACT,UAAU,EACV,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,uBAAuB,EACvB,SAAS,EACT,OAAO,EACP,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,EACN,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,MAAM,EACN,OAAO,EACP,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAChF,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,aAAa,EACb,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,EAC7B,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,qBAAqB,CAEtE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,YAAY,EAAE,MAAM,GAAG,YAAY,EACnC,OAAO,GAAE,YAAY,GAAG;IACtB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAqB3B"}

package/dist/internal/artifacts-store.d.ts

@@ -46,7 +46,18 @@ export declare class ArtifactsStore {
      * parsed output — defaults and coercions applied — is what gets stored.
      */
     private resolveKindAndData;
+    /**
+     * Trim to the retention cap from listing metadata alone. Past the cap
+     * this runs on every new-row insert, so it must not hydrate row bodies:
+     * on the Agent Store that is one read per row (~`max` reads per insert,
+     * forever, since eviction trims right back to the cap) — the 2026-09-18
+     * read storm on the security-reviewer deployment. The store listing
+     * carries last-modified metadata, and a row is rewritten on every upsert,
+     * so listing mtime orders rows the same way their `updatedAt` does.
+     */
     private evictPastCap;
+    /** The `excess` oldest row ids, cheapest available ordering first. */
+    private oldestRowIds;
 }
 /** Deterministic id for a keyed tag (same key ⇒ same id ⇒ upsert). */
 export declare function artifactIdForKey(key: string): string;

package/dist/internal/artifacts-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts-store.d.ts","sourceRoot":"","sources":["../../src/internal/artifacts-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AAkBrB,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAuC;IAEvD,YAAY,OAAO,EAAE,2BAA2B,EAa/C;IAED,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAIpD;YAEa,aAAa;IAkD3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEnD;IAED,sEAAsE;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEtD;IAEK,IAAI,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAUjE;IAED;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;YA8BZ,YAAY;CAgB3B;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD"}
+{"version":3,"file":"artifacts-store.d.ts","sourceRoot":"","sources":["../../src/internal/artifacts-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAEjB,MAAM,aAAa,CAAC;AAsCrB,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAuC;IAEvD,YAAY,OAAO,EAAE,2BAA2B,EAa/C;IAED,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAIpD;YAEa,aAAa;IAkD3B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEnD;IAED,sEAAsE;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEtD;IAEK,IAAI,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAUjE;IAED;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA8B1B;;;;;;;;OAQG;YACW,YAAY;IAc1B,sEAAsE;YACxD,YAAY;CAyB3B;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD"}

package/dist/internal/artifacts-store.js

@@ -22,6 +22,15 @@ import { join } from "node:path";
 import { resolveArtifactsMax } from "../artifacts.js";
 import { agentStoreKeys } from "../files.js";
 import { cursorHostedFiles, isCursorHostedFilesAvailable, } from "../files-backends/cursor-hosted.js";
+import { mapBounded } from "./bounded.js";
+/**
+ * Row-body hydration fan-out cap. `list()` fetches one object per row; on
+ * the Agent Store each fetch is a control-plane request, and an unbounded
+ * `Promise.all` over ~1k rows is a fleet-visible read burst (the 2026-09-18
+ * Agent Store read storm was this exact fan-out, run once per insert by the
+ * pre-metadata eviction path).
+ */
+const ROW_HYDRATION_CONCURRENCY = 8;
 /** Kind used by freeform tags when no kinds are declared. */
 export const ARTIFACT_DEFAULT_KIND = "artifact";
 /**
@@ -148,22 +157,53 @@ export class ArtifactsStore {
         }
         return { kind, data: input.data };
     }
+    /**
+     * Trim to the retention cap from listing metadata alone. Past the cap
+     * this runs on every new-row insert, so it must not hydrate row bodies:
+     * on the Agent Store that is one read per row (~`max` reads per insert,
+     * forever, since eviction trims right back to the cap) — the 2026-09-18
+     * read storm on the security-reviewer deployment. The store listing
+     * carries last-modified metadata, and a row is rewritten on every upsert,
+     * so listing mtime orders rows the same way their `updatedAt` does.
+     */
     evictPastCap() {
         return __awaiter(this, void 0, void 0, function* () {
-            if ((yield this.rows.count()) <= this.max) {
+            const metas = yield this.rows.listMeta();
+            const excess = metas.length - this.max;
+            if (excess <= 0) {
                 return;
             }
-            const records = yield this.rows.list();
-            if (records.length <= this.max) {
-                return;
+            for (const id of yield this.oldestRowIds(metas, excess)) {
+                yield this.rows.delete(id);
+                // Without the row body there is no `content` flag to consult; delete
+                // the payload unconditionally — absent payloads delete as a no-op.
+                yield this.content.delete(id);
             }
-            const oldestFirst = records.sort((a, b) => byNewestUpdated(b, a));
-            for (const record of oldestFirst.slice(0, records.length - this.max)) {
-                yield this.rows.delete(record.id);
-                if (record.content !== undefined) {
-                    yield this.content.delete(record.id);
-                }
+        });
+    }
+    /** The `excess` oldest row ids, cheapest available ordering first. */
+    oldestRowIds(metas, excess) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (metas.some(meta => meta.mtimeMs !== undefined)) {
+                // A store that tracks mtimes must never regress to per-insert
+                // hydration. The rare entry missing one (anomalous on such a store)
+                // sorts oldest via the comparator's `?? 0` and gets evicted first —
+                // evicting an anomaly beats re-reading every row on every insert.
+                return metas
+                    .sort(byOldestModified)
+                    .slice(0, excess)
+                    .map(meta => meta.id);
             }
+            // A store that tracks no modification times at all (the local
+            // filesystem store, deliberately) leaves only the rows' own
+            // `updatedAt`: hydrate — bounded — and order exactly. Corrupt rows
+            // drop out of `list()`, so recompute the excess against the rows that
+            // actually parsed.
+            const records = yield this.rows.list();
+            return records
+                .sort((a, b) => byNewestUpdated(b, a))
+                .slice(0, Math.max(0, records.length - this.max))
+                .map(record => record.id);
         });
     }
 }
@@ -174,6 +214,18 @@ export function artifactIdForKey(key) {
     }
     return `art_${createHash("sha256").update(key, "utf8").digest("hex").slice(0, 32)}`;
 }
+/**
+ * Oldest-modified first. Store mtimes can be coarse (S3 rounds to the
+ * second), so equal stamps tie-break by id — deterministic, and within a
+ * same-stamp cohort any victim is equally past the retention cap.
+ */
+function byOldestModified(a, b) {
+    var _a, _b;
+    if (a.mtimeMs !== b.mtimeMs) {
+        return ((_a = a.mtimeMs) !== null && _a !== void 0 ? _a : 0) - ((_b = b.mtimeMs) !== null && _b !== void 0 ? _b : 0);
+    }
+    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+}
 function byNewestUpdated(a, b) {
     if (a.updatedAt !== b.updatedAt) {
         return a.updatedAt < b.updatedAt ? 1 : -1;
@@ -245,7 +297,7 @@ function createSinkRowStore(sink, agentName) {
         list() {
             return __awaiter(this, void 0, void 0, function* () {
                 const entries = yield sink.list(agentStoreKeys.artifactRowPrefix(agentName));
-                const bodies = yield Promise.all(entries.map(entry => sink.get(entry.key)));
+                const bodies = yield mapBounded(entries, ROW_HYDRATION_CONCURRENCY, entry => sink.get(entry.key));
                 const records = [];
                 for (const body of bodies) {
                     const record = parseRecordBytes(sinkBody(body));
@@ -256,14 +308,43 @@ function createSinkRowStore(sink, agentName) {
                 return records;
             });
         },
-        count() {
+        listMeta() {
             return __awaiter(this, void 0, void 0, function* () {
-                const entries = yield sink.list(agentStoreKeys.artifactRowPrefix(agentName));
-                return entries.length;
+                const prefix = agentStoreKeys.artifactRowPrefix(agentName);
+                const metas = [];
+                for (const entry of yield sink.list(prefix)) {
+                    const id = rowIdFromName(entry.key.slice(prefix.length));
+                    if (id !== undefined) {
+                        metas.push({ id, mtimeMs: entry.mtimeMs });
+                    }
+                }
+                return metas;
             });
         },
     };
 }
+/**
+ * Invert the row naming scheme (`encodeURIComponent(id) + ".json"`).
+ * Foreign keys under the prefix — no `.json` suffix, malformed escapes,
+ * non-canonical encodings — read as absent rather than throwing. The
+ * round-trip check matters for eviction: a name that decodes but does not
+ * re-encode to itself (`a+b.json`, `foo bar.json`) would count toward the
+ * cap yet be undeletable through `key(id)`, leaving a phantom victim that
+ * every subsequent insert re-selects and fails to remove.
+ */
+function rowIdFromName(name) {
+    if (!name.endsWith(".json") || name.includes("/")) {
+        return undefined;
+    }
+    const encoded = name.slice(0, -".json".length);
+    try {
+        const id = decodeURIComponent(encoded);
+        return encodeURIComponent(id) === encoded ? id : undefined;
+    }
+    catch (_a) {
+        return undefined;
+    }
+}
 function createSinkContentStore(sink, agentName) {
     const key = (id) => agentStoreKeys.artifactContent(agentName, id);
     return {
@@ -344,18 +425,32 @@ function createFilesystemRowStore(stateRoot) {
                 return records;
             });
         },
-        count() {
+        listMeta() {
             return __awaiter(this, void 0, void 0, function* () {
+                // No mtimes on purpose: local rows are cheap to hydrate, and the
+                // rows' own `updatedAt` orders eviction exactly, immune to coarse
+                // filesystem timestamp granularity.
+                let names;
                 try {
-                    const names = yield readdir(dir);
-                    return names.filter(name => !name.startsWith(".") && name.endsWith(".json")).length;
+                    names = yield readdir(dir);
                 }
                 catch (error) {
                     if (error.code === "ENOENT") {
-                        return 0;
+                        return [];
                     }
                     throw error;
                 }
+                const metas = [];
+                for (const name of names) {
+                    if (name.startsWith(".")) {
+                        continue;
+                    }
+                    const id = rowIdFromName(name);
+                    if (id !== undefined) {
+                        metas.push({ id });
+                    }
+                }
+                return metas;
             });
         },
     };

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAOL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAoBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmG1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAirBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoEjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqGjB;AAwBD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAUD,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAiBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAuGD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAOL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAoBxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmG1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAirBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoEjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAgHjB;AAwBD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0BjB;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,YAAY,EAAE,MAAM,EAAE,EACtB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAUD,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAC/D,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAiBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAuGD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -1160,12 +1160,17 @@ export function cmdStop(slug, options) {
             }
         }
         const cancellation = "cancellation" in accepted ? accepted.cancellation : undefined;
+        // The backend escalates a publisher's stop of a multi-tenant app to the
+        // application-level suspension; say so, and how to undo it.
+        const stoppedGlobally = "scope" in accepted && accepted.scope === "global";
         if (ctx.noWait) {
             if (ctx.json) {
                 ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
             }
             else {
-                ctx.out(`Stop accepted for ${slug} (status: ${accepted.status}).\n`);
+                ctx.out(stoppedGlobally
+                    ? `Stop accepted for ${slug} across all tenants (status: ${accepted.status}).\n`
+                    : `Stop accepted for ${slug} (status: ${accepted.status}).\n`);
             }
             return (cancellation === null || cancellation === void 0 ? void 0 : cancellation.failed) === 0 || cancellation === undefined ? 0 : 1;
         }
@@ -1182,6 +1187,9 @@ export function cmdStop(slug, options) {
         if (ctx.json) {
             ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
         }
+        else if (stoppedGlobally) {
+            ctx.out(`Stopped ${slug} across all tenants (team ${ctx.teamId}); resume with \`${CLI} start ${slug} --global\`.\n`);
+        }
         else {
             ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
         }

package/dist/internal/cursor/cursor-api-transport.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The one resolution of "which Cursor control plane, as whom" for hosted
+ * transports. The verb-lane files sink (`files-backends/cursor-hosted.ts`)
+ * and the domain-lane store API client (`store-api-client.ts`) both build on
+ * these, so the pod credential and base URL resolve identically on every
+ * wire — one place to change, no drift between lanes.
+ */
+/**
+ * Same default as the hosted storage backend, inlined so these entrypoints
+ * do not import CLI code.
+ */
+export declare const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
+export interface CursorApiTransportOptions {
+    /** Control-plane base URL (default: `CURSOR_API_BASE_URL`, else api.cursor.com). */
+    baseUrl?: string;
+    /** Bearer credential (default: `CURSOR_API_KEY`). */
+    apiKey?: string;
+    /**
+     * Lazy credential, re-resolved on every call and preferred over
+     * {@link apiKey} — hosted freeze snapshots listen unsigned and bind the
+     * key file after serve start. Kept separate so `apiKey` stays a plain
+     * string.
+     */
+    resolveApiKey?: () => string | undefined;
+    /** Test seam; defaults to global fetch. */
+    fetch?: typeof fetch;
+}
+export declare function resolveCursorApiBaseUrl(options: CursorApiTransportOptions): string;
+/**
+ * The pod credential is the whole authorization on every hosted wire: the
+ * API resolves the caller's deployment from it, so there is no second,
+ * narrower credential to manage. Fails loudly rather than defaulting —
+ * calling the control plane as nobody is worse than not calling.
+ */
+export declare function resolveCursorApiKey(options: CursorApiTransportOptions): string;
+export declare function resolveCursorApiFetch(options: CursorApiTransportOptions): typeof fetch;
+//# sourceMappingURL=cursor-api-transport.d.ts.map

package/dist/internal/cursor/cursor-api-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-api-transport.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/cursor-api-transport.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE,MAAM,WAAW,yBAAyB;IACxC,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACzC,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAOD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,GACjC,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,yBAAyB,GACjC,MAAM,CASR;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,KAAK,CAMd"}

package/dist/internal/cursor/cursor-api-transport.js

@@ -0,0 +1,44 @@
+/**
+ * The one resolution of "which Cursor control plane, as whom" for hosted
+ * transports. The verb-lane files sink (`files-backends/cursor-hosted.ts`)
+ * and the domain-lane store API client (`store-api-client.ts`) both build on
+ * these, so the pod credential and base URL resolve identically on every
+ * wire — one place to change, no drift between lanes.
+ */
+/**
+ * Same default as the hosted storage backend, inlined so these entrypoints
+ * do not import CLI code.
+ */
+export const DEFAULT_CURSOR_EXTERNAL_API_URL = "https://api.cursor.com";
+function trimTrailingSlash(raw) {
+    const trimmed = raw.trim();
+    return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
+}
+export function resolveCursorApiBaseUrl(options) {
+    var _a, _b;
+    return trimTrailingSlash((_b = (_a = options.baseUrl) !== null && _a !== void 0 ? _a : process.env.CURSOR_API_BASE_URL) !== null && _b !== void 0 ? _b : DEFAULT_CURSOR_EXTERNAL_API_URL);
+}
+/**
+ * The pod credential is the whole authorization on every hosted wire: the
+ * API resolves the caller's deployment from it, so there is no second,
+ * narrower credential to manage. Fails loudly rather than defaulting —
+ * calling the control plane as nobody is worse than not calling.
+ */
+export function resolveCursorApiKey(options) {
+    var _a, _b;
+    var _c;
+    const configured = (_c = (_a = options.resolveApiKey) === null || _a === void 0 ? void 0 : _a.call(options)) !== null && _c !== void 0 ? _c : options.apiKey;
+    const key = (_b = (configured !== null && configured !== void 0 ? configured : process.env.CURSOR_API_KEY)) === null || _b === void 0 ? void 0 : _b.trim();
+    if (key === undefined || key === "") {
+        throw new Error("Cursor hosted transport requires CURSOR_API_KEY (deployment pod credential on Cursor hosting)");
+    }
+    return key;
+}
+export function resolveCursorApiFetch(options) {
+    var _a;
+    const impl = (_a = options.fetch) !== null && _a !== void 0 ? _a : globalThis.fetch;
+    if (typeof impl !== "function") {
+        throw new Error("Cursor hosted transport requires fetch");
+    }
+    return impl;
+}

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -16,6 +16,27 @@ export declare const DEFAULT_AGENT_SERVE_STORE_PROTOCOL_FILE = "/run/cursor/secr
  * directions.
  */
 export declare const AGENT_SERVE_FACTORY_FLUSH_PROTOCOL = "factory-flush-v1";
+/**
+ * Pin value additionally enabling the domain-call lane
+ * (`POST /internal/agentsdk/store/api/<call>`), where the server owns the
+ * storage pattern for framework state — starting with `memory.append`. A
+ * strict superset of {@link AGENT_SERVE_FACTORY_FLUSH_PROTOCOL}: verbs keep
+ * riding the factory flush wire under this pin too. The same fail-safe
+ * applies in both directions — an unknown value keeps today's behavior, and
+ * re-pinning to `factory-flush-v1` turns the domain lane back off without a
+ * client change.
+ */
+export declare const AGENT_SERVE_FACTORY_API_PROTOCOL = "factory-api-v1";
+/**
+ * Does this pin select the factory flush wire for the store verbs? True for
+ * the flush pin and for the domain-API superset pin.
+ */
+export declare function storeProtocolEnablesFactoryFlush(protocol: string | undefined): boolean;
+/**
+ * Does this pin enable the domain-call lane (server-owned storage patterns)?
+ * Only its exact value does; everything else keeps the client-side patterns.
+ */
+export declare function storeProtocolEnablesStoreApi(protocol: string | undefined): boolean;
 /** Deployment user-land store: env, then task-bind file. */
 export declare function resolveDeploymentStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
 /** Engine framework store: env, then task-bind file. */

package/dist/internal/cursor/hosted-store-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AAE9D,eAAO,MAAM,uCAAuC,mDACF,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,qBAAqB,CAAC;AA8BrE,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAYzB"}
+{"version":3,"file":"hosted-store-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-store-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,wCAAwC,oDACF,CAAC;AAEpD,eAAO,MAAM,kDAAkD,8DACF,CAAC;AAE9D,eAAO,MAAM,uCAAuC,mDACF,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,qBAAqB,CAAC;AAErE;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,mBAAmB,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAKT;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAET;AA8BD,4DAA4D;AAC5D,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,wDAAwD;AACxD,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,CAYzB"}

package/dist/internal/cursor/hosted-store-secrets.js

@@ -17,6 +17,32 @@ export const DEFAULT_AGENT_SERVE_STORE_PROTOCOL_FILE = "/run/cursor/secrets/AGEN
  * directions.
  */
 export const AGENT_SERVE_FACTORY_FLUSH_PROTOCOL = "factory-flush-v1";
+/**
+ * Pin value additionally enabling the domain-call lane
+ * (`POST /internal/agentsdk/store/api/<call>`), where the server owns the
+ * storage pattern for framework state — starting with `memory.append`. A
+ * strict superset of {@link AGENT_SERVE_FACTORY_FLUSH_PROTOCOL}: verbs keep
+ * riding the factory flush wire under this pin too. The same fail-safe
+ * applies in both directions — an unknown value keeps today's behavior, and
+ * re-pinning to `factory-flush-v1` turns the domain lane back off without a
+ * client change.
+ */
+export const AGENT_SERVE_FACTORY_API_PROTOCOL = "factory-api-v1";
+/**
+ * Does this pin select the factory flush wire for the store verbs? True for
+ * the flush pin and for the domain-API superset pin.
+ */
+export function storeProtocolEnablesFactoryFlush(protocol) {
+    return (protocol === AGENT_SERVE_FACTORY_FLUSH_PROTOCOL ||
+        protocol === AGENT_SERVE_FACTORY_API_PROTOCOL);
+}
+/**
+ * Does this pin enable the domain-call lane (server-owned storage patterns)?
+ * Only its exact value does; everything else keeps the client-side patterns.
+ */
+export function storeProtocolEnablesStoreApi(protocol) {
+    return protocol === AGENT_SERVE_FACTORY_API_PROTOCOL;
+}
 const STORE_SOURCE_ID_ENV = "AGENT_SERVE_STORE_SOURCE_ID";
 const FRAMEWORK_STORE_SOURCE_ID_ENV = "AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID";
 const STORE_SOURCE_ID_FILE_ENV = "AGENT_SERVE_STORE_SOURCE_ID_FILE";

package/dist/internal/cursor/store-api-client.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The store API client: July's one gateway to the factory domain-call lane,
+ * `POST /internal/agentsdk/store/api/<call>`. This module owns the whole
+ * transport — base URL and deployment credential (the same resolution the
+ * files sink uses, via `cursor-api-transport.ts`), envelope encoding,
+ * response validation, typed error mapping, and the bounded backoff policy.
+ * Feature modules (`memory.ts`, later `session-run-log.ts`, …) call typed
+ * methods like {@link StoreApiClient.memoryAppend} and never hand-roll
+ * fetch; future domain calls (`sessionRun.report`, `startLog.flush`, …) are
+ * added here as new methods on this one client.
+ *
+ * The lane is selected per pod by the task-bound store protocol pin:
+ * {@link isStoreApiLaneEnabled} is true only under the exact
+ * `factory-api-v1` pin AND with a provisioned deployment store. The
+ * availability check is not redundant: the pin file is written by the hosted
+ * task bind, but a local-dev env var could name the pin without any store to
+ * serve reads — appending into the void. Both resolve lazily per call, so a
+ * pin bound after serve start takes effect without a restart.
+ */
+import { type CursorApiTransportOptions } from "./cursor-api-transport.js";
+export interface StoreApiClientOptions extends CursorApiTransportOptions {
+    /** Deployment store source id override (lane availability check). */
+    storeSourceId?: string;
+    /** Lazy store source id, preferred over {@link storeSourceId}. */
+    resolveStoreSourceId?: () => string | undefined;
+    /** Lazy store protocol pin (default: env, then the task-bound file). */
+    resolveStoreProtocol?: () => string | undefined;
+    /** Backoff sleep override (tests). */
+    sleep?: (ms: number) => Promise<void>;
+    /** Jitter source override (tests). Returns [0, 1). */
+    random?: () => number;
+}
+/**
+ * How one domain call failed, after the client's bounded retries:
+ *
+ * - `rejected` — the server (or the client's own pre-check) refused the
+ *   payload with a typed 4xx. Deterministic; never retried.
+ * - `shed` — 429 from the per-deployment limiter or kill switch. Retried
+ *   only within the small Retry-After bound below; retrying harder against
+ *   a shed is exactly the stampede the domain lane exists to prevent.
+ * - `unavailable` — 5xx or a network failure, retried up to the attempt
+ *   bound.
+ * - `bad_response` — a 2xx whose body failed the response schema; a
+ *   contract break, not a transient, so never retried.
+ */
+export type StoreApiFailureKind = "rejected" | "shed" | "unavailable" | "bad_response";
+export declare class StoreApiCallError extends Error {
+    readonly kind: StoreApiFailureKind;
+    readonly status?: number | undefined;
+    constructor(kind: StoreApiFailureKind, message: string, status?: number | undefined);
+}
+/**
+ * Is the domain-call lane on for this pod? Exact pin match plus a
+ * provisioned deployment store; anything else keeps the client-side
+ * patterns, fail-safe in both directions like the flush pin itself.
+ */
+export declare function isStoreApiLaneEnabled(options?: StoreApiClientOptions): boolean;
+export type StoreApiClient = {
+    /**
+     * One `memory.append` domain call: the server appends the record to a
+     * server-owned journal shard. Resolves on success; throws
+     * {@link StoreApiCallError} after the bounded retries. The caller owns the
+     * failure policy (memory drops the record — appending is advisory).
+     */
+    memoryAppend(payload: {
+        agent: string;
+        record: Record<string, unknown>;
+    }): Promise<void>;
+    /**
+     * One `memory.read` domain call plus the presigned byte fetch: the server
+     * flushes the agent's pending append buffer (best-effort) and presigns
+     * the canonical journal; this method then downloads it. Undefined while
+     * the agent has no journal. Throws {@link StoreApiCallError} after the
+     * bounded retries — the caller owns the failure policy (hydration keeps
+     * the existing mirror).
+     */
+    memoryReadContent(payload: {
+        agent: string;
+    }): Promise<Uint8Array | undefined>;
+};
+export declare function createStoreApiClient(options?: StoreApiClientOptions): StoreApiClient;
+//# sourceMappingURL=store-api-client.d.ts.map

package/dist/internal/cursor/store-api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-api-client.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/store-api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,OAAO,EACL,KAAK,yBAAyB,EAI/B,MAAM,2BAA2B,CAAC;AAOnC,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACtE,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAChD,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAChD,sCAAsC;IACtC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,MAAM,GACN,aAAa,GACb,cAAc,CAAC;AAEnB,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,mBAAmB;IAElC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAH1B,YACW,IAAI,EAAE,mBAAmB,EAClC,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AA6BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAYT;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,OAAO,EAAE;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB;;;;;;;OAOG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACrC,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAwMhB"}