@cursor/july 0.1.55 → 0.1.61

package/dist/channels/origin/index.js

@@ -0,0 +1,28 @@
+/**
+ * Origin webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultOriginAuth, originChannel } from "@cursor/july/channels/origin";
+ *
+ * export default originChannel({
+ *   cursorAccount: { repos: ["owner/repo"] },
+ *   onPullRequest: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ *   onComment: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode verifies Standard-Webhooks v1ed signatures **and**
+ * binds `envelope.appId` to {@link OriginChannelOptions.appId} (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`). v1ed alone is not channel auth — Origin
+ * signs every app's deliveries with the same JWKS. Pass
+ * `{ cursorAccount: true }` to receive events from
+ * `serve({ cursor: { events: true } })` after `/v0/scm-events`
+ * (`provider: "origin"`) already verified them. The turn principal is
+ * `origin-webhook` plus the Origin actor — not the Cursor subscriber —
+ * matching GitHub's `github-webhook` pattern.
+ */
+export * from "./cursor-account.js";
+export * from "./events.js";
+export * from "./origin-channel.js";
+export * from "./origin-webhook.js";
+export * from "./types.js";

package/dist/channels/origin/origin-channel.d.ts

@@ -0,0 +1,68 @@
+import type { AuthContext, ChannelDefinition, ChannelHandlerArgs } from "../../types.js";
+import type { OriginChannelOptions, OriginEventContext, OriginPullRequestEvent, OriginTurnDispatch, OriginWebhookEnvelope } from "./types.js";
+/** `AGENT_SERVE_ORIGIN_APP_ID` fallback for {@link OriginChannelOptions.appId}. */
+export declare function envOriginAppId(): string | undefined;
+export declare function parseOriginWebhookEnvelope(payload: unknown): OriginWebhookEnvelope | null;
+export declare function parseOriginPullRequestEvent(input: {
+    envelope: OriginWebhookEnvelope;
+}): {
+    ctx: Omit<OriginEventContext, "host" | "artifacts">;
+    pullRequest: OriginPullRequestEvent;
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultOriginAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as {@link defaultGitHubAuth}).
+ */
+export declare function defaultOriginAuth(ctx: Omit<OriginEventContext, "host" | "artifacts">): AuthContext;
+export declare function originContinuationKey(ctx: Pick<OriginEventContext, "repository" | "pullRequestNumber">): string;
+export declare function defaultOriginTitle(ctx: Pick<OriginEventContext, "repository" | "pullRequestNumber">): string;
+export declare function defaultOriginPullRequestMessage(ctx: Omit<OriginEventContext, "host" | "artifacts">, pullRequest: OriginPullRequestEvent): string;
+export declare function defaultOriginPullRequestDispatch(ctx: Omit<OriginEventContext, "host" | "artifacts">, pullRequest: OriginPullRequestEvent): OriginTurnDispatch | null;
+/**
+ * Core Origin webhook dispatch used by {@link originChannel} routes and by
+ * {@link handleAgentServeTrigger} fan-out. Signature verification is the
+ * caller's responsibility (HTTP route verifies; internal fan-out skips).
+ */
+export declare function dispatchOriginWebhook(input: {
+    options: OriginChannelOptions;
+    envelope: OriginWebhookEnvelope;
+    args: ChannelHandlerArgs;
+}): Promise<Response>;
+/**
+ * HTTP entry for a single agent's Origin channel: optional v1ed verify, then
+ * app-id bind, then {@link dispatchOriginWebhook}.
+ */
+export declare function handleOriginWebhookRequest(input: {
+    options: OriginChannelOptions;
+    request: Request;
+    args: ChannelHandlerArgs;
+    /** When true, skip v1ed even though Origin HTTP deliveries are signed. */
+    skipSignatureVerification?: boolean;
+}): Promise<Response>;
+export declare function getOriginChannelOptions(definition: object): OriginChannelOptions | undefined;
+export declare function originChannel(options?: OriginChannelOptions): ChannelDefinition;
+/** Minimal mount shape shared by `serve` / trigger fan-out. */
+export interface OriginAgentMountLike {
+    slug: string;
+    project: {
+        channels: Array<{
+            id: string;
+            definition: {
+                meta?: {
+                    kind?: string;
+                    originWebhookEvents?: readonly string[];
+                };
+            };
+        }>;
+    };
+}
+export interface OriginChannelTarget {
+    slug: string;
+    channelId: string;
+    events: string[];
+}
+export declare function findOriginChannelTargets(mounts: ReadonlyArray<OriginAgentMountLike>): OriginChannelTarget[];
+//# sourceMappingURL=origin-channel.d.ts.map

package/dist/channels/origin/origin-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/origin-channel.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAEV,oBAAoB,EAGpB,kBAAkB,EAClB,sBAAsB,EAItB,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAiFpB,mFAAmF;AACnF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAGnD;AAqGD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,GACf,qBAAqB,GAAG,IAAI,CAG9B;AAuCD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,EAAE,qBAAqB,CAAC;CACjC,GAAG;IACF,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;IACpD,WAAW,EAAE,sBAAsB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,GAAG,IAAI,CAoDP;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,GAClD,WAAW,CAeb;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,mBAAmB,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,mBAAmB,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EACnD,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EACnD,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAuHD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuGpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0CpB;AAOD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAsDnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;aACnE,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAC1C,mBAAmB,EAAE,CAgBvB"}

package/dist/channels/origin/origin-channel.js

@@ -0,0 +1,567 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { z } from "zod";
+import { allowAll, defineChannel, localDevStrict, loopbackOnly, POST, } from "../../channels.js";
+import { isDevMode } from "../../internal/dev-mode.js";
+import { parseCursorOriginRepoScope, registerOriginCursorAccountRuntime, } from "./cursor-account.js";
+import { deriveOriginWebhookEvents, ORIGIN_CHANNEL_KIND } from "./events.js";
+import { DEFAULT_ORIGIN_API_BASE_URL, verifyOriginWebhook, } from "./origin-webhook.js";
+/**
+ * Default dispatch gate when no `onPullRequest` hook is declared: the common
+ * review triggers start a turn as the delivery's actor.
+ */
+const DEFAULT_PULL_REQUEST_TYPES = new Set([
+    "pull_request.created",
+    "pull_request.published",
+    "pull_request.head_ref.pushed",
+    "pull_request.base_ref.updated",
+]);
+function asRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function asNonEmptyString(value) {
+    return typeof value === "string" && value.trim() !== ""
+        ? value.trim()
+        : undefined;
+}
+function asPositiveInt(value) {
+    if (typeof value === "number" && Number.isInteger(value) && value > 0) {
+        return value;
+    }
+    if (typeof value === "string" && /^[1-9]\d*$/.test(value)) {
+        return Number(value);
+    }
+    return undefined;
+}
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function originActor(value) {
+    var _a;
+    var _b, _c, _d;
+    const record = asRecord(value);
+    if (record === undefined)
+        return undefined;
+    const nestedUser = asRecord(record.user);
+    const nestedApp = asRecord(record.app);
+    const id = (_d = (_c = (_b = asNonEmptyString(nestedUser === null || nestedUser === void 0 ? void 0 : nestedUser.id)) !== null && _b !== void 0 ? _b : asNonEmptyString(nestedApp === null || nestedApp === void 0 ? void 0 : nestedApp.id)) !== null && _c !== void 0 ? _c : asNonEmptyString((_a = asRecord(record.serviceAccount)) === null || _a === void 0 ? void 0 : _a.id)) !== null && _d !== void 0 ? _d : asNonEmptyString(record.id);
+    if (id === undefined)
+        return undefined;
+    const kind = asNonEmptyString(record.kind);
+    return kind === undefined ? { id } : { id, kind };
+}
+function originHeaders(request) {
+    var _a, _b, _c;
+    return {
+        "webhook-id": (_a = request.headers.get("webhook-id")) !== null && _a !== void 0 ? _a : undefined,
+        "webhook-timestamp": (_b = request.headers.get("webhook-timestamp")) !== null && _b !== void 0 ? _b : undefined,
+        "webhook-signature": (_c = request.headers.get("webhook-signature")) !== null && _c !== void 0 ? _c : undefined,
+    };
+}
+function skipOriginVerify() {
+    var _a;
+    return ((_a = process.env.AGENT_SERVE_ORIGIN_SKIP_VERIFY) === null || _a === void 0 ? void 0 : _a.trim()) === "1";
+}
+/**
+ * Direct Origin HTTP deliveries verify v1ed. `--dev` and
+ * `AGENT_SERVE_ORIGIN_SKIP_VERIFY=1` skip that so local fixtures work, matching
+ * GitHub's unsigned loopback posture when no webhook secret is set.
+ */
+function shouldSkipOriginVerify() {
+    return skipOriginVerify() || isDevMode();
+}
+function asIdList(value) {
+    if (value === undefined)
+        return [];
+    const items = typeof value === "string" ? [value] : [...value];
+    return [...new Set(items.map((id) => id.trim()).filter(Boolean))];
+}
+/** `AGENT_SERVE_ORIGIN_APP_ID` fallback for {@link OriginChannelOptions.appId}. */
+export function envOriginAppId() {
+    var _a;
+    const value = (_a = process.env.AGENT_SERVE_ORIGIN_APP_ID) === null || _a === void 0 ? void 0 : _a.trim();
+    return value === undefined || value === "" ? undefined : value;
+}
+function configuredOriginAppIds(options) {
+    const fromOptions = asIdList(options.appId);
+    if (fromOptions.length > 0)
+        return fromOptions;
+    const fromEnv = envOriginAppId();
+    return fromEnv === undefined ? [] : [fromEnv];
+}
+function configuredOriginInstallationIds(options) {
+    return asIdList(options.installationId);
+}
+/**
+ * Repo allowlist for HTTP and trigger fan-out. `undefined` means no extra
+ * repo gate (the bound Origin app's installations still bound what Origin
+ * will send).
+ */
+function configuredOriginRepoAllowlist(options) {
+    const repos = [];
+    if (options.repos !== undefined) {
+        repos.push(...parseCursorOriginRepoScope(options.repos).repos);
+    }
+    if (typeof options.cursorAccount === "object") {
+        repos.push(...parseCursorOriginRepoScope(options.cursorAccount.repos).repos);
+    }
+    return repos.length === 0 ? undefined : new Set(repos);
+}
+/**
+ * v1ed proves Origin signed the body. Channel auth is the signed
+ * `envelope.appId` matching this channel's configured Origin app (the GitHub
+ * webhook-secret analogue). Cursor-internal documents the same gap.
+ */
+function originHttpBindingError(options, envelope) {
+    var _a, _b;
+    const allowedApps = configuredOriginAppIds(options);
+    if (allowedApps.length === 0) {
+        return "unbound_origin_app";
+    }
+    const deliveredAppId = (_a = envelope.appId) === null || _a === void 0 ? void 0 : _a.trim();
+    if (deliveredAppId === undefined || deliveredAppId === "") {
+        return "invalid_app";
+    }
+    if (!allowedApps.includes(deliveredAppId)) {
+        return "invalid_app";
+    }
+    const allowedInstalls = configuredOriginInstallationIds(options);
+    if (allowedInstalls.length === 0) {
+        return undefined;
+    }
+    const deliveredInstallationId = (_b = envelope.installationId) === null || _b === void 0 ? void 0 : _b.trim();
+    if (deliveredInstallationId === undefined ||
+        deliveredInstallationId === "" ||
+        !allowedInstalls.includes(deliveredInstallationId)) {
+        return "invalid_installation";
+    }
+    return undefined;
+}
+function resolveApiBaseUrl(options) {
+    const authored = typeof options.apiBaseUrl === "function"
+        ? options.apiBaseUrl()
+        : options.apiBaseUrl;
+    const trimmed = authored === null || authored === void 0 ? void 0 : authored.trim();
+    return trimmed === undefined || trimmed === ""
+        ? DEFAULT_ORIGIN_API_BASE_URL
+        : trimmed;
+}
+const originEnvelopeSchema = z.object({
+    deliveryId: z.string().optional(),
+    appId: z.string().optional(),
+    installationId: z.string().optional(),
+    sender: z
+        .object({
+        id: z.string().min(1),
+        kind: z.string().optional(),
+    })
+        .optional(),
+    event: z.object({
+        id: z.string().optional(),
+        type: z.string().min(1),
+        eventTime: z.string().optional(),
+        payload: z.unknown().optional(),
+    }),
+});
+export function parseOriginWebhookEnvelope(payload) {
+    const parsed = originEnvelopeSchema.safeParse(payload);
+    return parsed.success ? parsed.data : null;
+}
+function originRepoFromPayload(payload) {
+    var _a, _b;
+    var _c;
+    const repository = (_c = asRecord(payload.repository)) !== null && _c !== void 0 ? _c : asRecord((_a = asRecord(payload.pullRequest)) === null || _a === void 0 ? void 0 : _a.repository);
+    const owner = asNonEmptyString((_b = asRecord(repository === null || repository === void 0 ? void 0 : repository.owner)) === null || _b === void 0 ? void 0 : _b.slug);
+    const name = asNonEmptyString(repository === null || repository === void 0 ? void 0 : repository.name);
+    if (owner === undefined || name === undefined)
+        return undefined;
+    return { owner, name, fullName: `${owner}/${name}` };
+}
+function originPrUrl(repository, number, explicit) {
+    return (explicit !== null && explicit !== void 0 ? explicit : `https://cursor.com/codebase/${repository.owner}/${repository.name}/pull/${number}`);
+}
+function originSender(envelope, payload) {
+    var _a, _b, _c;
+    var _d, _e, _f, _g, _h;
+    return ((_h = (_g = (_f = (_e = (_d = envelope.sender) !== null && _d !== void 0 ? _d : originActor(payload.actor)) !== null && _e !== void 0 ? _e : originActor(payload.pusher)) !== null && _f !== void 0 ? _f : originActor((_a = asRecord(payload.review)) === null || _a === void 0 ? void 0 : _a.author)) !== null && _g !== void 0 ? _g : originActor((_b = asRecord(payload.comment)) === null || _b === void 0 ? void 0 : _b.author)) !== null && _h !== void 0 ? _h : originActor((_c = asRecord(payload.pullRequest)) === null || _c === void 0 ? void 0 : _c.author));
+}
+export function parseOriginPullRequestEvent(input) {
+    var _a, _b, _c, _d;
+    const payload = (_a = asRecord(input.envelope.event.payload)) !== null && _a !== void 0 ? _a : {};
+    const repository = originRepoFromPayload(payload);
+    const pullRequest = asRecord(payload.pullRequest);
+    const number = asPositiveInt(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.number);
+    if (repository === undefined || number === undefined) {
+        return null;
+    }
+    const eventType = input.envelope.event.type;
+    const url = originPrUrl(repository, number, asNonEmptyString(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.url));
+    const head = asRecord(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.head);
+    const base = asRecord(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.base);
+    const version = asRecord(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.version);
+    const author = originActor(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.author);
+    return {
+        payload,
+        ctx: {
+            deliveryId: input.envelope.deliveryId,
+            eventType,
+            repository,
+            pullRequestNumber: number,
+            pullRequestUrl: url,
+            sender: originSender(input.envelope, payload),
+        },
+        pullRequest: {
+            type: eventType,
+            number,
+            url,
+            title: asNonEmptyString(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.title),
+            body: (pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.body) === null
+                ? null
+                : ((_b = asNonEmptyString(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.body)) !== null && _b !== void 0 ? _b : (typeof (pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.body) === "string"
+                    ? pullRequest.body
+                    : undefined)),
+            draft: asBoolean(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.draft),
+            merged: eventType === "pull_request.merged" || asBoolean(pullRequest === null || pullRequest === void 0 ? void 0 : pullRequest.merged),
+            authorId: author === null || author === void 0 ? void 0 : author.id,
+            headRef: asNonEmptyString(head === null || head === void 0 ? void 0 : head.ref),
+            headSha: (_c = asNonEmptyString(head === null || head === void 0 ? void 0 : head.sha)) !== null && _c !== void 0 ? _c : asNonEmptyString(version === null || version === void 0 ? void 0 : version.headSha),
+            baseRef: asNonEmptyString(base === null || base === void 0 ? void 0 : base.ref),
+            baseSha: (_d = asNonEmptyString(base === null || base === void 0 ? void 0 : base.sha)) !== null && _d !== void 0 ? _d : asNonEmptyString(version === null || version === void 0 ? void 0 : version.baseSha),
+        },
+    };
+}
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultOriginAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as {@link defaultGitHubAuth}).
+ */
+export function defaultOriginAuth(ctx) {
+    var _a, _b, _c;
+    const senderId = (_a = ctx.sender) === null || _a === void 0 ? void 0 : _a.id;
+    return {
+        authenticator: "origin-webhook",
+        principalId: senderId !== null && senderId !== void 0 ? senderId : "origin",
+        principalType: ((_b = ctx.sender) === null || _b === void 0 ? void 0 : _b.kind) === "app" ? "service" : "user",
+        attributes: Object.assign(Object.assign(Object.assign(Object.assign({ conversation_kind: "pull_request", repository: ctx.repository.fullName }, (ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId })), (senderId === undefined ? {} : { subject: senderId })), (((_c = ctx.sender) === null || _c === void 0 ? void 0 : _c.kind) === undefined ? {} : { user_type: ctx.sender.kind })), { issuer: `origin:${ctx.repository.owner}` }),
+    };
+}
+export function originContinuationKey(ctx) {
+    return `origin-pr:${ctx.repository.fullName}#${ctx.pullRequestNumber}`;
+}
+export function defaultOriginTitle(ctx) {
+    return `Origin ${ctx.repository.fullName}#${ctx.pullRequestNumber}`;
+}
+export function defaultOriginPullRequestMessage(ctx, pullRequest) {
+    const head = pullRequest.headRef !== undefined && pullRequest.headSha !== undefined
+        ? `Head: ${pullRequest.headRef} (${pullRequest.headSha})`
+        : undefined;
+    return [
+        `Origin pull request trigger: ${ctx.repository.fullName}#${pullRequest.number}`,
+        `Event: ${pullRequest.type}`,
+        `URL: ${pullRequest.url}`,
+        ...(pullRequest.title === undefined ? [] : [`Title: ${pullRequest.title}`]),
+        ...(head === undefined ? [] : [head]),
+        "Handle this pull request event.",
+    ].join("\n");
+}
+export function defaultOriginPullRequestDispatch(ctx, pullRequest) {
+    if (!DEFAULT_PULL_REQUEST_TYPES.has(pullRequest.type)) {
+        return null;
+    }
+    return { auth: defaultOriginAuth(ctx) };
+}
+function isTaskDispatch(dispatch) {
+    return "task" in dispatch;
+}
+function enrichEventContext(input) {
+    return Object.assign(Object.assign({}, input.ctx), { host: input.args.host, artifacts: input.args.artifacts });
+}
+function skipped(reason, extra = {}) {
+    return Response.json(Object.assign({ ok: true, skipped: true, reason }, extra));
+}
+function acknowledgeTask(args, dispatch, extra) {
+    args.waitUntil(new Promise((resolve, reject) => {
+        setImmediate(() => {
+            Promise.resolve()
+                .then(dispatch.task)
+                .then(() => resolve(), reject);
+        });
+    }));
+    return Response.json(Object.assign({ ok: true, dispatched: true, mode: "task" }, extra), { status: 202 });
+}
+function startTurn(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const session = yield input.args.send(input.message, Object.assign({ auth: input.dispatch.auth, continuationToken: originContinuationKey(input.ctx), title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultOriginTitle(input.ctx) }, (input.cloud === undefined ? {} : { cloud: input.cloud })));
+        return Response.json({
+            ok: true,
+            sessionId: session.id,
+            isNew: session.isNew,
+            continuationToken: session.continuationToken,
+        });
+    });
+}
+function resolveCloudOptions(cloud, ctx, pullRequest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (cloud === undefined || cloud === false) {
+            return undefined;
+        }
+        if (cloud === true) {
+            return {
+                repos: [
+                    {
+                        url: `https://cursor.com/codebase/${ctx.repository.fullName}`,
+                        prUrl: pullRequest.url,
+                        startingRef: pullRequest.headSha,
+                    },
+                ],
+            };
+        }
+        if (typeof cloud === "function") {
+            return yield cloud(ctx, pullRequest);
+        }
+        return cloud;
+    });
+}
+function applyDispatch(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        if (input.dispatch === null) {
+            return skipped("not_dispatched", input.extra);
+        }
+        if (isTaskDispatch(input.dispatch)) {
+            return acknowledgeTask(input.args, input.dispatch, input.extra);
+        }
+        const message = [
+            (_a = input.dispatch.message) !== null && _a !== void 0 ? _a : input.message,
+            ...((_b = input.dispatch.context) !== null && _b !== void 0 ? _b : []),
+        ].join("\n");
+        return startTurn({
+            args: input.args,
+            ctx: input.ctx,
+            message,
+            dispatch: input.dispatch,
+            cloud: input.cloud,
+        });
+    });
+}
+/**
+ * Core Origin webhook dispatch used by {@link originChannel} routes and by
+ * {@link handleAgentServeTrigger} fan-out. Signature verification is the
+ * caller's responsibility (HTTP route verifies; internal fan-out skips).
+ */
+export function dispatchOriginWebhook(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const eventType = input.envelope.event.type;
+        const parsed = parseOriginPullRequestEvent({ envelope: input.envelope });
+        if (parsed === null) {
+            return Response.json({ ok: false, error: "invalid_origin_payload" }, { status: 400 });
+        }
+        const ctx = enrichEventContext({ ctx: parsed.ctx, args: input.args });
+        const { pullRequest, payload } = parsed;
+        const repoAllowlist = configuredOriginRepoAllowlist(input.options);
+        if (repoAllowlist !== undefined &&
+            !repoAllowlist.has(ctx.repository.fullName.toLowerCase())) {
+            return skipped("repo_not_allowed", { repo: ctx.repository.fullName });
+        }
+        if (eventType.startsWith("pull_request.comment.")) {
+            if (input.options.onComment === undefined) {
+                return skipped("no_handler", { event: eventType });
+            }
+            const commentRecord = asRecord(payload.comment);
+            const commentId = asNonEmptyString(commentRecord === null || commentRecord === void 0 ? void 0 : commentRecord.id);
+            const commentBody = typeof (commentRecord === null || commentRecord === void 0 ? void 0 : commentRecord.body) === "string" ? commentRecord.body : undefined;
+            if (commentId === undefined || commentBody === undefined) {
+                return Response.json({ ok: false, error: "invalid_origin_comment_payload" }, { status: 400 });
+            }
+            const comment = {
+                id: commentId,
+                body: commentBody,
+                author: originActor(commentRecord === null || commentRecord === void 0 ? void 0 : commentRecord.author),
+            };
+            const dispatch = yield input.options.onComment(ctx, comment);
+            return applyDispatch({
+                args: input.args,
+                ctx,
+                dispatch,
+                extra: { event: eventType },
+                message: `Origin comment on ${ctx.repository.fullName}#${ctx.pullRequestNumber}`,
+            });
+        }
+        if (eventType.startsWith("pull_request.review.")) {
+            if (input.options.onReview === undefined) {
+                return skipped("no_handler", { event: eventType });
+            }
+            const reviewRecord = (_a = asRecord(payload.review)) !== null && _a !== void 0 ? _a : {};
+            const review = {
+                id: asNonEmptyString(reviewRecord.id),
+                verdict: asNonEmptyString(reviewRecord.verdict),
+                author: originActor(reviewRecord.author),
+            };
+            const dispatch = yield input.options.onReview(ctx, review);
+            return applyDispatch({
+                args: input.args,
+                ctx,
+                dispatch,
+                extra: { event: eventType },
+                message: `Origin review on ${ctx.repository.fullName}#${ctx.pullRequestNumber}`,
+            });
+        }
+        if (eventType.startsWith("pull_request.")) {
+            const dispatch = input.options.onPullRequest === undefined
+                ? defaultOriginPullRequestDispatch(ctx, pullRequest)
+                : yield input.options.onPullRequest(ctx, pullRequest);
+            const cloud = yield resolveCloudOptions(input.options.cloud, ctx, pullRequest);
+            return applyDispatch({
+                args: input.args,
+                ctx,
+                dispatch,
+                extra: { event: eventType },
+                message: defaultOriginPullRequestMessage(ctx, pullRequest),
+                cloud,
+            });
+        }
+        if (input.options.onEvent !== undefined) {
+            const dispatch = yield input.options.onEvent(ctx, {
+                eventType,
+                payload,
+            });
+            return applyDispatch({
+                args: input.args,
+                ctx,
+                dispatch,
+                extra: { event: eventType },
+                message: `Origin ${eventType} event`,
+            });
+        }
+        return skipped("unsupported_event", { event: eventType });
+    });
+}
+/**
+ * HTTP entry for a single agent's Origin channel: optional v1ed verify, then
+ * app-id bind, then {@link dispatchOriginWebhook}.
+ */
+export function handleOriginWebhookRequest(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const bodyText = yield input.request.text();
+        const requireHttpBinding = input.skipSignatureVerification !== true &&
+            shouldSkipOriginVerify() !== true;
+        if (requireHttpBinding) {
+            try {
+                yield verifyOriginWebhook(bodyText, originHeaders(input.request), {
+                    apiBaseUrl: resolveApiBaseUrl(input.options),
+                });
+            }
+            catch (_a) {
+                return Response.json({ ok: false, error: "invalid_signature" }, { status: 401 });
+            }
+        }
+        let payload;
+        try {
+            payload = JSON.parse(bodyText);
+        }
+        catch (_b) {
+            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+        }
+        const envelope = parseOriginWebhookEnvelope(payload);
+        if (envelope === null) {
+            return Response.json({ ok: false, error: "invalid_origin_payload" }, { status: 400 });
+        }
+        if (requireHttpBinding) {
+            const bindingError = originHttpBindingError(input.options, envelope);
+            if (bindingError !== undefined) {
+                return Response.json({ ok: false, error: bindingError }, { status: 401 });
+            }
+        }
+        return dispatchOriginWebhook({
+            options: input.options,
+            envelope,
+            args: input.args,
+        });
+    });
+}
+const originChannelOptionsByDefinition = new WeakMap();
+export function getOriginChannelOptions(definition) {
+    return originChannelOptionsByDefinition.get(definition);
+}
+export function originChannel(options = {}) {
+    var _a, _b;
+    const usesCursorAccount = options.cursorAccount === true || typeof options.cursorAccount === "object";
+    const cursorScope = typeof options.cursorAccount === "object"
+        ? parseCursorOriginRepoScope(options.cursorAccount.repos)
+        : undefined;
+    if (options.repos !== undefined) {
+        parseCursorOriginRepoScope(options.repos);
+    }
+    const routePath = (_a = options.path) !== null && _a !== void 0 ? _a : "/";
+    // v1ed + configured app id is the request auth (allowAll), matching GitHub
+    // HMAC + webhookSecret. Without an app id, prod stays loopback-strict so a
+    // reachable URL cannot be driven by any Origin-signed delivery. `--dev`
+    // / skip-verify admits loopback only.
+    const auth = (_b = options.auth) !== null && _b !== void 0 ? _b : [
+        (request, info) => (shouldSkipOriginVerify()
+            ? loopbackOnly()
+            : configuredOriginAppIds(options).length > 0
+                ? allowAll()
+                : localDevStrict())(request, info),
+    ];
+    const definition = defineChannel({
+        auth,
+        onStart: options.onStart,
+        onStop: options.onStop,
+        meta: {
+            kind: ORIGIN_CHANNEL_KIND,
+            originWebhookEvents: deriveOriginWebhookEvents(options),
+        },
+        routes: [
+            POST(routePath, {
+                bodySchema: z.unknown(),
+                description: "Origin webhook ingress",
+                handler: (request, args) => __awaiter(this, void 0, void 0, function* () {
+                    return handleOriginWebhookRequest({
+                        options,
+                        request,
+                        args,
+                    });
+                }),
+            }),
+        ],
+    });
+    originChannelOptionsByDefinition.set(definition, options);
+    if (usesCursorAccount) {
+        registerOriginCursorAccountRuntime(definition, {
+            options,
+            scope: cursorScope,
+        });
+    }
+    return definition;
+}
+export function findOriginChannelTargets(mounts) {
+    var _a;
+    const targets = [];
+    for (const { slug, project } of mounts) {
+        for (const channel of project.channels) {
+            const meta = channel.definition.meta;
+            if ((meta === null || meta === void 0 ? void 0 : meta.kind) !== ORIGIN_CHANNEL_KIND) {
+                continue;
+            }
+            targets.push({
+                slug,
+                channelId: channel.id,
+                events: [...((_a = meta.originWebhookEvents) !== null && _a !== void 0 ? _a : [])],
+            });
+        }
+    }
+    return targets;
+}