@cursor/july 0.1.55 → 0.1.62

package/dist/channels/origin/cursor-account.js

@@ -0,0 +1,35 @@
+/**
+ * Cursor-account mode for Origin channels.
+ *
+ * Origin identity is the signed-in Cursor user (no third-party OAuth). The
+ * channel declares repos at definition time; the serve host subscribes
+ * `/v0/scm-events` with `provider: "origin"` as that user. Unlike GitHub,
+ * there is no installation token to mint — outbound Origin API calls already
+ * authenticate as the Cursor principal.
+ */
+export const CURSOR_ORIGIN_MAX_REPOS = 20;
+const CURSOR_ORIGIN_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const runtimeByDefinition = new WeakMap();
+export function parseCursorOriginRepoScope(values) {
+    const repos = [
+        ...new Set(values.map((repo) => repo.trim().toLowerCase()).filter(Boolean)),
+    ];
+    if (repos.length === 0) {
+        throw new Error("originChannel({ cursorAccount }) requires at least one repository.");
+    }
+    if (repos.length > CURSOR_ORIGIN_MAX_REPOS) {
+        throw new Error(`originChannel({ cursorAccount }) supports at most ${CURSOR_ORIGIN_MAX_REPOS} repositories.`);
+    }
+    for (const repo of repos) {
+        if (!CURSOR_ORIGIN_REPO_PATTERN.test(repo) || repo.includes("..")) {
+            throw new Error(`Invalid Origin repository "${repo}"; expected owner/repo.`);
+        }
+    }
+    return { repos };
+}
+export function registerOriginCursorAccountRuntime(definition, runtime) {
+    runtimeByDefinition.set(definition, runtime);
+}
+export function getOriginCursorAccountRuntime(definition) {
+    return runtimeByDefinition.get(definition);
+}

package/dist/channels/origin/events.d.ts

@@ -0,0 +1,10 @@
+/** {@link ChannelMeta.kind} value used by {@link originChannel}. */
+export declare const ORIGIN_CHANNEL_KIND = "origin";
+export interface OriginWebhookEventOptions {
+    webhookEvents?: readonly string[];
+    onComment?: unknown;
+    onReview?: unknown;
+    onEvent?: unknown;
+}
+export declare function deriveOriginWebhookEvents(options: OriginWebhookEventOptions): string[];
+//# sourceMappingURL=events.d.ts.map

package/dist/channels/origin/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/events.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAc5C,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,yBAAyB,GACjC,MAAM,EAAE,CAgBV"}

package/dist/channels/origin/events.js

@@ -0,0 +1,27 @@
+/** {@link ChannelMeta.kind} value used by {@link originChannel}. */
+export const ORIGIN_CHANNEL_KIND = "origin";
+const BASE_WEBHOOK_EVENTS = [
+    "pull_request.created",
+    "pull_request.published",
+    "pull_request.head_ref.pushed",
+    "pull_request.base_ref.updated",
+    "pull_request.closed",
+    "pull_request.merged",
+];
+const COMMENT_EVENTS = ["pull_request.comment.created"];
+const REVIEW_EVENTS = ["pull_request.review.submitted"];
+export function deriveOriginWebhookEvents(options) {
+    if (options.webhookEvents !== undefined) {
+        return [
+            ...new Set(options.webhookEvents.map((event) => event.trim()).filter(Boolean)),
+        ];
+    }
+    const events = [...BASE_WEBHOOK_EVENTS];
+    if (options.onComment !== undefined) {
+        events.push(...COMMENT_EVENTS);
+    }
+    if (options.onReview !== undefined) {
+        events.push(...REVIEW_EVENTS);
+    }
+    return [...new Set(events)];
+}

package/dist/channels/origin/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Origin webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultOriginAuth, originChannel } from "@cursor/july/channels/origin";
+ *
+ * export default originChannel({
+ *   cursorAccount: { repos: ["owner/repo"] },
+ *   onPullRequest: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ *   onComment: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode verifies Standard-Webhooks v1ed signatures **and**
+ * binds `envelope.appId` to {@link OriginChannelOptions.appId} (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`). v1ed alone is not channel auth — Origin
+ * signs every app's deliveries with the same JWKS. Pass
+ * `{ cursorAccount: true }` to receive events from
+ * `serve({ cursor: { events: true } })` after `/v0/scm-events`
+ * (`provider: "origin"`) already verified them. The turn principal is
+ * `origin-webhook` plus the Origin actor — not the Cursor subscriber —
+ * matching GitHub's `github-webhook` pattern.
+ */
+export * from "./cursor-account.js";
+export * from "./events.js";
+export * from "./origin-channel.js";
+export * from "./origin-webhook.js";
+export * from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/channels/origin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC"}

package/dist/channels/origin/index.js

@@ -0,0 +1,28 @@
+/**
+ * Origin webhook channel pack for agent-serve.
+ *
+ * ```ts
+ * import { defaultOriginAuth, originChannel } from "@cursor/july/channels/origin";
+ *
+ * export default originChannel({
+ *   cursorAccount: { repos: ["owner/repo"] },
+ *   onPullRequest: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ *   onComment: (ctx) => ({ auth: defaultOriginAuth(ctx) }),
+ * });
+ * ```
+ *
+ * Direct webhook mode verifies Standard-Webhooks v1ed signatures **and**
+ * binds `envelope.appId` to {@link OriginChannelOptions.appId} (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`). v1ed alone is not channel auth — Origin
+ * signs every app's deliveries with the same JWKS. Pass
+ * `{ cursorAccount: true }` to receive events from
+ * `serve({ cursor: { events: true } })` after `/v0/scm-events`
+ * (`provider: "origin"`) already verified them. The turn principal is
+ * `origin-webhook` plus the Origin actor — not the Cursor subscriber —
+ * matching GitHub's `github-webhook` pattern.
+ */
+export * from "./cursor-account.js";
+export * from "./events.js";
+export * from "./origin-channel.js";
+export * from "./origin-webhook.js";
+export * from "./types.js";

package/dist/channels/origin/origin-channel.d.ts

@@ -0,0 +1,68 @@
+import type { AuthContext, ChannelDefinition, ChannelHandlerArgs } from "../../types.js";
+import type { OriginChannelOptions, OriginEventContext, OriginPullRequestEvent, OriginTurnDispatch, OriginWebhookEnvelope } from "./types.js";
+/** `AGENT_SERVE_ORIGIN_APP_ID` fallback for {@link OriginChannelOptions.appId}. */
+export declare function envOriginAppId(): string | undefined;
+export declare function parseOriginWebhookEnvelope(payload: unknown): OriginWebhookEnvelope | null;
+export declare function parseOriginPullRequestEvent(input: {
+    envelope: OriginWebhookEnvelope;
+}): {
+    ctx: Omit<OriginEventContext, "host" | "artifacts">;
+    pullRequest: OriginPullRequestEvent;
+    payload: Record<string, unknown>;
+} | null;
+/**
+ * Derive the turn's auth from the actor that triggered the delivery — the
+ * standard `{ auth: defaultOriginAuth(ctx) }` dispatch from an inbound hook.
+ * The subscriber's Cursor identity is not the turn principal (same pattern
+ * as {@link defaultGitHubAuth}).
+ */
+export declare function defaultOriginAuth(ctx: Omit<OriginEventContext, "host" | "artifacts">): AuthContext;
+export declare function originContinuationKey(ctx: Pick<OriginEventContext, "repository" | "pullRequestNumber">): string;
+export declare function defaultOriginTitle(ctx: Pick<OriginEventContext, "repository" | "pullRequestNumber">): string;
+export declare function defaultOriginPullRequestMessage(ctx: Omit<OriginEventContext, "host" | "artifacts">, pullRequest: OriginPullRequestEvent): string;
+export declare function defaultOriginPullRequestDispatch(ctx: Omit<OriginEventContext, "host" | "artifacts">, pullRequest: OriginPullRequestEvent): OriginTurnDispatch | null;
+/**
+ * Core Origin webhook dispatch used by {@link originChannel} routes and by
+ * {@link handleAgentServeTrigger} fan-out. Signature verification is the
+ * caller's responsibility (HTTP route verifies; internal fan-out skips).
+ */
+export declare function dispatchOriginWebhook(input: {
+    options: OriginChannelOptions;
+    envelope: OriginWebhookEnvelope;
+    args: ChannelHandlerArgs;
+}): Promise<Response>;
+/**
+ * HTTP entry for a single agent's Origin channel: optional v1ed verify, then
+ * app-id bind, then {@link dispatchOriginWebhook}.
+ */
+export declare function handleOriginWebhookRequest(input: {
+    options: OriginChannelOptions;
+    request: Request;
+    args: ChannelHandlerArgs;
+    /** When true, skip v1ed even though Origin HTTP deliveries are signed. */
+    skipSignatureVerification?: boolean;
+}): Promise<Response>;
+export declare function getOriginChannelOptions(definition: object): OriginChannelOptions | undefined;
+export declare function originChannel(options?: OriginChannelOptions): ChannelDefinition;
+/** Minimal mount shape shared by `serve` / trigger fan-out. */
+export interface OriginAgentMountLike {
+    slug: string;
+    project: {
+        channels: Array<{
+            id: string;
+            definition: {
+                meta?: {
+                    kind?: string;
+                    originWebhookEvents?: readonly string[];
+                };
+            };
+        }>;
+    };
+}
+export interface OriginChannelTarget {
+    slug: string;
+    channelId: string;
+    events: string[];
+}
+export declare function findOriginChannelTargets(mounts: ReadonlyArray<OriginAgentMountLike>): OriginChannelTarget[];
+//# sourceMappingURL=origin-channel.d.ts.map

package/dist/channels/origin/origin-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/origin-channel.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,gBAAgB,CAAC;AAWxB,OAAO,KAAK,EAEV,oBAAoB,EAGpB,kBAAkB,EAClB,sBAAsB,EAItB,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAiFpB,mFAAmF;AACnF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAGnD;AAqGD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,GACf,qBAAqB,GAAG,IAAI,CAG9B;AAuCD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,EAAE,qBAAqB,CAAC;CACjC,GAAG;IACF,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;IACpD,WAAW,EAAE,sBAAsB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,GAAG,IAAI,CAoDP;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,GAClD,WAAW,CAeb;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,mBAAmB,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,mBAAmB,CAAC,GAChE,MAAM,CAER;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EACnD,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,WAAW,CAAC,EACnD,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAuHD;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuGpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,0EAA0E;IAC1E,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0CpB;AAOD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,GACjB,oBAAoB,GAAG,SAAS,CAElC;AAED,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAsDnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,UAAU,EAAE;gBACV,IAAI,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;iBAAE,CAAC;aACnE,CAAC;SACH,CAAC,CAAC;KACJ,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,GAC1C,mBAAmB,EAAE,CAgBvB"}