@cursor/july 0.1.73 → 0.1.75

package/dist/channels/github/checks.js

@@ -1,16 +1,16 @@
 /**
- * Generic CI checks (GitHub Checks API) for agent authors.
+ * GitHub CI checks (Checks API) — the GitHub {@link CiCheckWriter} behind the
+ * shared check lifecycle in `../checks.js`.
  *
- * `createGitHubCheck` opens a merge-box check run on a commit and returns a
- * handle for updating and concluding it, so an agent can report its own CI
- * result (name, summary, and a "Details" link — e.g. the agent session run).
- * Works with any client exposing `getOctokit()` (`ctx.github`,
+ * `createGitHubCheck` opens a merge-box check run on a commit and returns the
+ * shared `CiCheck` handle; `resumeGitHubCheck` rebuilds one from a stored
+ * check-run id. Works with any client exposing `getOctokit()` (`ctx.github`,
  * `ctx.host.github`), and is also reachable as `ctx.github.createCheck(...)`.
  *
  * Posting checks needs `checks:write`. With `cursorAccount`, declare
  * `githubChannel({ checks: true })` so the hosted lease is minted on the
  * `contents-write` tier; GitHub App / PAT credentials need the equivalent
- * permission.
+ * permission. API failures are normalized into `GitHubApiError`.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -21,7 +21,53 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { wrapOctokitError, } from "./api.js";
+import { openCiCheck, resumeCiCheck, } from "../checks.js";
+import { wrapOctokitError } from "./api.js";
+/**
+ * GitHub writer: first write creates the check run (capturing its id), later
+ * writes patch it.
+ */
+function githubCheckWriter(input) {
+    let checkRunId = input.checkRunId;
+    return (write) => __awaiter(this, void 0, void 0, function* () {
+        const octokit = yield input.github.getOctokit();
+        const base = {
+            owner: input.owner,
+            repo: input.repo,
+            name: input.name,
+            status: write.status,
+            conclusion: write.conclusion,
+            completed_at: write.completedAt,
+            details_url: write.detailsUrl,
+            output: write.output,
+        };
+        if (checkRunId === undefined) {
+            if (input.sha === undefined) {
+                throw new Error("githubChannel: cannot create a check without a sha.");
+            }
+            try {
+                const response = yield octokit.rest.checks.create(Object.assign(Object.assign({}, base), { head_sha: input.sha, started_at: write.startedAt }));
+                checkRunId = response.data.id;
+                return {
+                    id: response.data.id,
+                    url: typeof response.data.html_url === "string"
+                        ? response.data.html_url
+                        : undefined,
+                };
+            }
+            catch (error) {
+                throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/check-runs`);
+            }
+        }
+        try {
+            yield octokit.rest.checks.update(Object.assign(Object.assign({}, base), { check_run_id: checkRunId }));
+            return undefined;
+        }
+        catch (error) {
+            throw wrapOctokitError(error, "PATCH", `/repos/${input.owner}/${input.repo}/check-runs/${checkRunId}`);
+        }
+    });
+}
 /**
  * Create a CI check run on a commit and return a handle for later updates.
  *
@@ -40,69 +86,15 @@ import { wrapOctokitError, } from "./api.js";
  * ```
  */
 export function createGitHubCheck(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const octokit = yield input.github.getOctokit();
-        let created;
-        try {
-            const response = yield octokit.rest.checks.create({
-                owner: input.owner,
-                repo: input.repo,
-                name: input.name,
-                head_sha: input.sha,
-                status: (_a = input.status) !== null && _a !== void 0 ? _a : "in_progress",
-                started_at: new Date().toISOString(),
-                details_url: input.detailsUrl,
-                output: input.output,
-            });
-            created = response.data;
-        }
-        catch (error) {
-            throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/check-runs`);
-        }
-        return resumeGitHubCheck({
-            github: input.github,
-            owner: input.owner,
-            repo: input.repo,
-            name: input.name,
-            checkRunId: created.id,
-            url: typeof created.html_url === "string" ? created.html_url : undefined,
-        });
-    });
+    return openCiCheck(githubCheckWriter(input), input);
 }
 /**
  * Rebuild a {@link GitHubCheck} handle for an existing check run id (e.g.
  * after a process restart). No API call is made until the first update.
  */
 export function resumeGitHubCheck(input) {
-    const patch = (update) => __awaiter(this, void 0, void 0, function* () {
-        const octokit = yield input.github.getOctokit();
-        try {
-            yield octokit.rest.checks.update({
-                owner: input.owner,
-                repo: input.repo,
-                check_run_id: input.checkRunId,
-                name: input.name,
-                status: update.status,
-                conclusion: update.conclusion,
-                completed_at: update.status === "completed" ? new Date().toISOString() : undefined,
-                details_url: update.detailsUrl,
-                output: update.output,
-            });
-        }
-        catch (error) {
-            throw wrapOctokitError(error, "PATCH", `/repos/${input.owner}/${input.repo}/check-runs/${input.checkRunId}`);
-        }
-    });
-    return {
+    return resumeCiCheck(githubCheckWriter(input), {
         id: input.checkRunId,
         url: input.url,
-        update: patch,
-        conclude: (conclude) => patch({
-            status: "completed",
-            conclusion: conclude.conclusion,
-            detailsUrl: conclude.detailsUrl,
-            output: conclude.output,
-        }),
-    };
+    });
 }

package/dist/channels/origin/api.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
+ *
+ * Origin writes such as CI check runs are installation-only: they need an
+ * `oit_…` installation token minted from Origin app credentials (EdDSA app
+ * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
+ * consolidates that flow so agents configure credentials once and call
+ * {@link createOriginClient} — the GitHub-channel analogue of
+ * `createGitHubOctokit`.
+ *
+ * Credentials resolve from options first, then the environment:
+ * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
+ * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
+ * app's Ed25519 key; literal `\n` sequences are normalized), and
+ * `ORIGIN_API_BASE_URL` for the public REST base.
+ */
+/**
+ * Public Origin REST base (check runs, installation tokens). Distinct from
+ * the webhook JWKS base (`DEFAULT_ORIGIN_API_BASE_URL` in
+ * `origin-webhook.ts`).
+ */
+export declare const DEFAULT_ORIGIN_PUBLIC_API_BASE_URL = "https://api.cursor.com";
+export type OriginApiMethod = "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+/** Normalized Origin REST failure — the `GitHubApiError` analogue. */
+export declare class OriginApiError extends Error {
+    readonly body: unknown;
+    readonly method: string;
+    readonly path: string;
+    readonly status: number;
+    constructor(input: {
+        body: unknown;
+        method: string;
+        path: string;
+        status: number;
+    });
+}
+/** Yields a bearer for Origin REST calls (usually a short-lived `oit_…`). */
+export type OriginTokenProvider = () => Promise<string>;
+export interface OriginAppCredentials {
+    /** Origin app id (`app_<typeid>`). */
+    appId: string;
+    /** Installation the token is minted for. */
+    installationId: string;
+    /** PKCS8 PEM for the app's EdDSA (Ed25519) private key. */
+    privateKey: string;
+}
+/** Each Origin app credential field found in the environment, when set. */
+export declare function resolveOriginAppCredentialParts(env?: NodeJS.ProcessEnv): Partial<OriginAppCredentials>;
+/**
+ * Read Origin app credentials from the environment. Returns `undefined` when
+ * incomplete so callers can fail with a clear message at use time instead of
+ * at startup.
+ */
+export declare function resolveOriginAppCredentials(env?: NodeJS.ProcessEnv): OriginAppCredentials | undefined;
+/** Public Origin REST base. Trailing slashes are stripped for path joins. */
+export declare function originPublicApiBaseUrl(env?: NodeJS.ProcessEnv): string;
+/**
+ * A cached per-use token provider for one set of app credentials. Every call
+ * inside the reuse window returns the same `oit_…`; the first call after it
+ * re-mints.
+ */
+export declare function originAppTokenProvider(input: {
+    credentials: OriginAppCredentials;
+    apiBaseUrl?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): OriginTokenProvider;
+export interface OriginClientOptions {
+    /** Static bearer (`oit_…`) or refreshing provider used for every call. */
+    token?: string | OriginTokenProvider;
+    /**
+     * App credentials to mint installation tokens from. Defaults to the
+     * environment ({@link resolveOriginAppCredentials}).
+     */
+    credentials?: OriginAppCredentials;
+    /** Public Origin REST base. Defaults to `ORIGIN_API_BASE_URL` / prod. */
+    apiBaseUrl?: string;
+    /** Injectable fetch for tests. */
+    fetch?: typeof fetch;
+}
+/** Minimal authenticated Origin REST client (the `Octokit` analogue). */
+export interface OriginClient {
+    readonly apiBaseUrl: string;
+    /**
+     * Call an Origin public REST path (e.g. `/v1/origin/repos/o/r/check-runs`).
+     * Throws {@link OriginApiError} on non-2xx responses.
+     */
+    request<T = unknown>(input: {
+        method: OriginApiMethod;
+        path: string;
+        body?: unknown;
+    }): Promise<T>;
+}
+/**
+ * Build an authenticated Origin REST client. Auth resolution: explicit
+ * token/provider, then app credentials (options or environment). Missing
+ * auth fails at the first request with a clear message.
+ */
+export declare function createOriginClient(options?: OriginClientOptions): OriginClient;
+//# sourceMappingURL=api.d.ts.map

package/dist/channels/origin/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAS3E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,GAAG,SAAS,CAWlC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AA8DD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAoEd"}

package/dist/channels/origin/api.js

@@ -0,0 +1,225 @@
+/**
+ * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
+ *
+ * Origin writes such as CI check runs are installation-only: they need an
+ * `oit_…` installation token minted from Origin app credentials (EdDSA app
+ * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
+ * consolidates that flow so agents configure credentials once and call
+ * {@link createOriginClient} — the GitHub-channel analogue of
+ * `createGitHubOctokit`.
+ *
+ * Credentials resolve from options first, then the environment:
+ * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
+ * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
+ * app's Ed25519 key; literal `\n` sequences are normalized), and
+ * `ORIGIN_API_BASE_URL` for the public REST base.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Buffer } from "node:buffer";
+import { createPrivateKey, sign } from "node:crypto";
+/**
+ * Public Origin REST base (check runs, installation tokens). Distinct from
+ * the webhook JWKS base (`DEFAULT_ORIGIN_API_BASE_URL` in
+ * `origin-webhook.ts`).
+ */
+export const DEFAULT_ORIGIN_PUBLIC_API_BASE_URL = "https://api.cursor.com";
+/** Fixed audience for Origin app JWTs (`APP_TOKEN_AUDIENCE` backend-side). */
+const ORIGIN_APP_TOKEN_AUDIENCE = "origin-apps";
+const APP_JWT_TTL_SECONDS = 5 * 60;
+/** Re-mint the `oit_` token after this long; tokens outlive it comfortably. */
+const TOKEN_REUSE_MS = 4 * 60 * 1000;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 30000;
+/** Normalized Origin REST failure — the `GitHubApiError` analogue. */
+export class OriginApiError extends Error {
+    constructor(input) {
+        super(`Origin ${input.method} ${input.path} failed with HTTP ${input.status}.`);
+        this.name = "OriginApiError";
+        this.body = input.body;
+        this.method = input.method;
+        this.path = input.path;
+        this.status = input.status;
+    }
+}
+/** Vault/env round-trip: literal `\n` sequences appear in practice. */
+function normalizePrivateKeyPem(raw) {
+    const pem = raw === null || raw === void 0 ? void 0 : raw.trim().replace(/\\n/g, "\n");
+    return pem === undefined || pem === "" ? undefined : pem;
+}
+function envValue(value) {
+    const trimmed = value === null || value === void 0 ? void 0 : value.trim();
+    return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+}
+/** Each Origin app credential field found in the environment, when set. */
+export function resolveOriginAppCredentialParts(env = process.env) {
+    var _a;
+    return {
+        appId: (_a = envValue(env.ORIGIN_APP_ID)) !== null && _a !== void 0 ? _a : envValue(env.AGENT_SERVE_ORIGIN_APP_ID),
+        installationId: envValue(env.ORIGIN_APP_INSTALLATION_ID),
+        privateKey: normalizePrivateKeyPem(env.ORIGIN_APP_PRIVATE_KEY),
+    };
+}
+/**
+ * Read Origin app credentials from the environment. Returns `undefined` when
+ * incomplete so callers can fail with a clear message at use time instead of
+ * at startup.
+ */
+export function resolveOriginAppCredentials(env = process.env) {
+    const { appId, installationId, privateKey } = resolveOriginAppCredentialParts(env);
+    if (appId === undefined ||
+        installationId === undefined ||
+        privateKey === undefined) {
+        return undefined;
+    }
+    return { appId, installationId, privateKey };
+}
+/** Public Origin REST base. Trailing slashes are stripped for path joins. */
+export function originPublicApiBaseUrl(env = process.env) {
+    var _a;
+    const fromEnv = (_a = envValue(env.ORIGIN_API_BASE_URL)) === null || _a === void 0 ? void 0 : _a.replace(/\/+$/, "");
+    return fromEnv !== null && fromEnv !== void 0 ? fromEnv : DEFAULT_ORIGIN_PUBLIC_API_BASE_URL;
+}
+function base64UrlJson(value) {
+    return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+function mintOriginAppJwt(credentials, nowMs) {
+    const now = Math.floor(nowMs / 1000);
+    const header = base64UrlJson({
+        alg: "EdDSA",
+        kid: credentials.appId,
+        typ: "JWT",
+    });
+    const payload = base64UrlJson({
+        iss: credentials.appId,
+        aud: ORIGIN_APP_TOKEN_AUDIENCE,
+        iat: now,
+        exp: now + APP_JWT_TTL_SECONDS,
+    });
+    const signingInput = `${header}.${payload}`;
+    const key = createPrivateKey(credentials.privateKey);
+    const signature = sign(null, Buffer.from(signingInput), key).toString("base64url");
+    return `${signingInput}.${signature}`;
+}
+function mintOriginInstallationToken(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const jwt = mintOriginAppJwt(input.credentials, input.nowMs);
+        const path = `/v1/origin/app/installations/${encodeURIComponent(input.credentials.installationId)}/access_tokens`;
+        const response = yield input.fetchImpl(`${input.apiBaseUrl}${path}`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${jwt}` },
+            signal: AbortSignal.timeout(TOKEN_EXCHANGE_TIMEOUT_MS),
+        });
+        const body = yield response.json().catch(() => undefined);
+        const token = typeof body === "object" && body !== null && !Array.isArray(body)
+            ? body.token
+            : undefined;
+        if (!response.ok || typeof token !== "string" || token === "") {
+            // Never echo the body: on success it contains the installation token.
+            throw new OriginApiError({
+                body: undefined,
+                method: "POST",
+                path,
+                status: response.status,
+            });
+        }
+        return token;
+    });
+}
+/**
+ * A cached per-use token provider for one set of app credentials. Every call
+ * inside the reuse window returns the same `oit_…`; the first call after it
+ * re-mints.
+ */
+export function originAppTokenProvider(input) {
+    var _a, _b, _c;
+    const apiBaseUrl = (_a = input.apiBaseUrl) !== null && _a !== void 0 ? _a : originPublicApiBaseUrl();
+    const fetchImpl = (_b = input.fetch) !== null && _b !== void 0 ? _b : fetch;
+    const now = (_c = input.now) !== null && _c !== void 0 ? _c : Date.now;
+    let cached;
+    return () => __awaiter(this, void 0, void 0, function* () {
+        const nowMs = now();
+        if (cached !== undefined && nowMs - cached.mintedAtMs < TOKEN_REUSE_MS) {
+            return cached.token;
+        }
+        const token = yield mintOriginInstallationToken({
+            credentials: input.credentials,
+            apiBaseUrl,
+            fetchImpl,
+            nowMs,
+        });
+        cached = { token, mintedAtMs: nowMs };
+        return token;
+    });
+}
+/**
+ * Build an authenticated Origin REST client. Auth resolution: explicit
+ * token/provider, then app credentials (options or environment). Missing
+ * auth fails at the first request with a clear message.
+ */
+export function createOriginClient(options = {}) {
+    var _a, _b;
+    const apiBaseUrl = ((_a = options.apiBaseUrl) !== null && _a !== void 0 ? _a : originPublicApiBaseUrl()).replace(/\/+$/, "");
+    const fetchImpl = (_b = options.fetch) !== null && _b !== void 0 ? _b : fetch;
+    let tokenProvider;
+    const getToken = () => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (typeof options.token === "string") {
+            return options.token;
+        }
+        if (typeof options.token === "function") {
+            return yield options.token();
+        }
+        if (tokenProvider === undefined) {
+            const credentials = (_a = options.credentials) !== null && _a !== void 0 ? _a : resolveOriginAppCredentials();
+            if (credentials === undefined) {
+                throw new Error("originClient: no Origin credential available (pass token / credentials, or set ORIGIN_APP_ID + ORIGIN_APP_INSTALLATION_ID + ORIGIN_APP_PRIVATE_KEY).");
+            }
+            tokenProvider = originAppTokenProvider({
+                credentials,
+                apiBaseUrl,
+                fetch: fetchImpl,
+            });
+        }
+        return yield tokenProvider();
+    });
+    return {
+        apiBaseUrl,
+        request(input) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const path = input.path.startsWith("/") ? input.path : `/${input.path}`;
+                const token = yield getToken();
+                const response = yield fetchImpl(`${apiBaseUrl}${path}`, {
+                    method: input.method,
+                    headers: Object.assign({ authorization: `Bearer ${token}` }, (input.body === undefined
+                        ? {}
+                        : { "content-type": "application/json" })),
+                    body: input.body === undefined ? undefined : JSON.stringify(input.body),
+                });
+                const text = yield response.text();
+                let parsed;
+                try {
+                    parsed = text === "" ? undefined : JSON.parse(text);
+                }
+                catch (_a) {
+                    parsed = text;
+                }
+                if (!response.ok) {
+                    throw new OriginApiError({
+                        body: parsed,
+                        method: input.method,
+                        path,
+                        status: response.status,
+                    });
+                }
+                return parsed;
+            });
+        },
+    };
+}

package/dist/channels/origin/binding.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Rebuild the Origin API handle (`ctx.origin`) for inbound hooks.
+ *
+ * The handle is repo-bound and lazy: no credential is resolved until the
+ * first call, so channels without outbound Origin credentials still dispatch
+ * normally. Credential resolution combines the channel's `app` option with
+ * the environment (`ORIGIN_APP_ID` / `ORIGIN_APP_INSTALLATION_ID` /
+ * `ORIGIN_APP_PRIVATE_KEY`); the delivery's installation id fills in when
+ * neither pins one — the GitHub webhook `installation.id` analogue.
+ */
+import { type OriginApiMethod } from "./api.js";
+import { type OriginCheck, type OriginCheckCreateInput } from "./checks.js";
+import type { OriginAppOptions, OriginRepositoryRef } from "./types.js";
+/** Origin operations exposed to hooks (`ctx.origin`). */
+export interface OriginHandle {
+    /** Installation id the outbound credential is minted for, when known. */
+    installationId: string | undefined;
+    repository: OriginRepositoryRef;
+    /**
+     * Call an Origin public REST path with the channel's app credential.
+     * Throws `OriginApiError` on API failure.
+     */
+    request<T = unknown>(input: {
+        method: OriginApiMethod;
+        path: string;
+        body?: unknown;
+    }): Promise<T>;
+    /**
+     * Open a CI check run on `sha` and get a handle for updating and
+     * concluding it. Needs an app installation with
+     * `repository:checks:write` — Origin check writes are installation-only.
+     */
+    createCheck(input: Omit<OriginCheckCreateInput, "origin" | "owner" | "repo">): Promise<OriginCheck>;
+}
+export declare function buildOriginBinding(input: {
+    repository: OriginRepositoryRef;
+    /** Installation id from the delivery envelope, when present. */
+    installationId?: string;
+    /** Channel-authored outbound app credentials / API base. */
+    app?: OriginAppOptions;
+    /** Injectable fetch for tests. */
+    fetch?: typeof fetch;
+}): OriginHandle;
+//# sourceMappingURL=binding.d.ts.map

package/dist/channels/origin/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,mBAAmB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACf;;;;OAIG;IACH,WAAW,CACT,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC,GAC/D,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,UAAU,EAAE,mBAAmB,CAAC;IAChC,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,YAAY,CAuCf"}

package/dist/channels/origin/binding.js

@@ -0,0 +1,45 @@
+/**
+ * Rebuild the Origin API handle (`ctx.origin`) for inbound hooks.
+ *
+ * The handle is repo-bound and lazy: no credential is resolved until the
+ * first call, so channels without outbound Origin credentials still dispatch
+ * normally. Credential resolution combines the channel's `app` option with
+ * the environment (`ORIGIN_APP_ID` / `ORIGIN_APP_INSTALLATION_ID` /
+ * `ORIGIN_APP_PRIVATE_KEY`); the delivery's installation id fills in when
+ * neither pins one — the GitHub webhook `installation.id` analogue.
+ */
+import { createOriginClient, resolveOriginAppCredentialParts, } from "./api.js";
+import { createOriginCheck, } from "./checks.js";
+export function buildOriginBinding(input) {
+    var _a;
+    var _b;
+    let client;
+    const getClient = () => {
+        var _a, _b, _c, _d, _e;
+        var _f, _g, _h, _j;
+        if (client === undefined) {
+            const fromEnv = resolveOriginAppCredentialParts();
+            const appId = (_f = (_a = input.app) === null || _a === void 0 ? void 0 : _a.appId) !== null && _f !== void 0 ? _f : fromEnv.appId;
+            const installationId = (_h = (_g = (_b = input.app) === null || _b === void 0 ? void 0 : _b.installationId) !== null && _g !== void 0 ? _g : input.installationId) !== null && _h !== void 0 ? _h : fromEnv.installationId;
+            const privateKey = (_j = (_c = input.app) === null || _c === void 0 ? void 0 : _c.privateKey) !== null && _j !== void 0 ? _j : fromEnv.privateKey;
+            const credentials = appId !== undefined &&
+                installationId !== undefined &&
+                privateKey !== undefined
+                ? { appId, installationId, privateKey }
+                : undefined;
+            client = createOriginClient({
+                token: (_d = input.app) === null || _d === void 0 ? void 0 : _d.token,
+                credentials,
+                apiBaseUrl: (_e = input.app) === null || _e === void 0 ? void 0 : _e.apiBaseUrl,
+                fetch: input.fetch,
+            });
+        }
+        return client;
+    };
+    return {
+        installationId: (_b = (_a = input.app) === null || _a === void 0 ? void 0 : _a.installationId) !== null && _b !== void 0 ? _b : input.installationId,
+        repository: input.repository,
+        request: (request) => getClient().request(request),
+        createCheck: (check) => createOriginCheck(Object.assign(Object.assign({}, check), { origin: getClient(), owner: input.repository.owner, repo: input.repository.name })),
+    };
+}