@cursor/july 0.1.74 → 0.1.76

package/dist/internal/authored-alias-hooks.js

@@ -14,17 +14,27 @@
  *   project's own node_modules; `fallbackAliases` only apply when that
  *   fails (npx/global installs, projects without a local dependency), so a
  *   real install in the user's project keeps precedence.
+ *
+ * A third case is first-party factory agents that relative-import this
+ * package's `src/` from a monorepo checkout. Hosted engines `npm install`
+ * only the agent directory, so files under `packages/agent-serve/src` have
+ * no `node_modules`. Bare specifiers from that tree (`zod`, octokit, …)
+ * retry against the running `@cursor/july` package.json, which does.
  */
 // Null-prototype copies so specifiers like "constructor" or "__proto__"
 // can never resolve to inherited Object.prototype members.
 let directAliases = toNullProtoMap({});
 let fallbackAliases = toNullProtoMap({});
+let sourceTreeFallbackParentURL;
 function toNullProtoMap(source) {
     return Object.assign(Object.create(null), source);
 }
 export function initialize(data) {
     directAliases = toNullProtoMap(data.directAliases);
     fallbackAliases = toNullProtoMap(data.fallbackAliases);
+    const parent = data.sourceTreeFallbackParentURL;
+    sourceTreeFallbackParentURL =
+        typeof parent === "string" && parent !== "" ? parent : undefined;
 }
 export function resolve(specifier, context, nextResolve) {
     const direct = directAliases[specifier];
@@ -32,12 +42,54 @@ export function resolve(specifier, context, nextResolve) {
         return { url: direct, shortCircuit: true };
     }
     const fallback = fallbackAliases[specifier];
-    if (fallback === undefined) {
-        // Not ours: pass through with no promise/try-catch overhead. This hook
-        // runs on every module resolution in the process.
-        return nextResolve(specifier, context);
-    }
-    return Promise.resolve()
-        .then(() => nextResolve(specifier, context))
-        .catch(() => ({ url: fallback, shortCircuit: true }));
+    if (fallback !== undefined) {
+        return Promise.resolve()
+            .then(() => nextResolve(specifier, context))
+            .catch(() => ({ url: fallback, shortCircuit: true }));
+    }
+    if (sourceTreeFallbackParentURL !== undefined &&
+        isBarePackageSpecifier(specifier) &&
+        isMonorepoAgentServeSource(parentURLOf(context))) {
+        const retryParent = sourceTreeFallbackParentURL;
+        return Promise.resolve()
+            .then(() => nextResolve(specifier, context))
+            .catch(() => nextResolve(specifier, withParentURL(context, retryParent)));
+    }
+    // Not ours: pass through with no promise/try-catch overhead. This hook
+    // runs on every module resolution in the process.
+    return nextResolve(specifier, context);
+}
+function parentURLOf(context) {
+    if (context === null || typeof context !== "object") {
+        return undefined;
+    }
+    const parentURL = context.parentURL;
+    return typeof parentURL === "string" ? parentURL : undefined;
+}
+function withParentURL(context, parentURL) {
+    if (context !== null && typeof context === "object") {
+        return Object.assign(Object.assign({}, context), { parentURL });
+    }
+    return { parentURL };
+}
+function isBarePackageSpecifier(specifier) {
+    if (specifier.length === 0) {
+        return false;
+    }
+    const first = specifier[0];
+    if (first === "." || first === "/" || first === "\\") {
+        return false;
+    }
+    return !(specifier.startsWith("node:") ||
+        specifier.startsWith("file:") ||
+        specifier.startsWith("data:") ||
+        specifier.startsWith("http:") ||
+        specifier.startsWith("https:"));
+}
+function isMonorepoAgentServeSource(parentURL) {
+    if (parentURL === undefined) {
+        return false;
+    }
+    return (parentURL.includes("/packages/agent-serve/") &&
+        !parentURL.includes("/node_modules/"));
 }

package/dist/internal/authored-loaders.d.ts

@@ -11,9 +11,11 @@
  * imports of the framework resolve against the running package: the
  * historical `@anysphere/agent-serve[/x]` name always, and
  * `@cursor/july[/x]` / `@cursor/agentkit[/x]` as fallbacks when the user's
- * project has no local install (npx / global). Source runs (tsx from the
- * monorepo) skip both — the host loader and tsconfig paths already cover
- * them.
+ * project has no local install (npx / global). The same hooks retry bare
+ * npm specifiers from monorepo `packages/agent-serve/` source against this
+ * package (hosted factory engines install only the agent directory).
+ * Source runs (tsx from the monorepo) skip both — the host loader and
+ * tsconfig paths already cover them.
  */
 /**
  * ESM specifier for an authored agent/eval file.

package/dist/internal/authored-loaders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authored-loaders.d.ts","sourceRoot":"","sources":["../../src/internal/authored-loaders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyBH;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAIR;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAclC;AAID;;;;;GAKG;AACH,wBAAgB,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC,CAS7D"}
+{"version":3,"file":"authored-loaders.d.ts","sourceRoot":"","sources":["../../src/internal/authored-loaders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyBH;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,GACd,MAAM,CAIR;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAclC;AAID;;;;;GAKG;AACH,wBAAgB,6BAA6B,IAAI,OAAO,CAAC,IAAI,CAAC,CAS7D"}

package/dist/internal/authored-loaders.js

@@ -11,9 +11,11 @@
  * imports of the framework resolve against the running package: the
  * historical `@anysphere/agent-serve[/x]` name always, and
  * `@cursor/july[/x]` / `@cursor/agentkit[/x]` as fallbacks when the user's
- * project has no local install (npx / global). Source runs (tsx from the
- * monorepo) skip both — the host loader and tsconfig paths already cover
- * them.
+ * project has no local install (npx / global). The same hooks retry bare
+ * npm specifiers from monorepo `packages/agent-serve/` source against this
+ * package (hosted factory engines install only the agent directory).
+ * Source runs (tsx from the monorepo) skip both — the host loader and
+ * tsconfig paths already cover them.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -160,7 +162,14 @@ function registerFrameworkAliases() {
         fallbackAliases[`${AGENTKIT_PACKAGE_NAME}${suffix}`] = target;
     }
     const hooksUrl = new URL("./authored-alias-hooks.js", import.meta.url);
-    const data = { directAliases, fallbackAliases };
+    const data = {
+        directAliases,
+        fallbackAliases,
+        // Hosted factory agents relative-import this package's src/ from a
+        // monorepo checkout while npm install ran only in the agent directory.
+        // Bare specifiers from that tree retry against this package.json.
+        sourceTreeFallbackParentURL: pathToFileURL(join(packageRootDir(), "package.json")).href,
+    };
     // `node:module`'s register() is synchronous: it blocks until the hooks
     // thread has initialized, so the aliases are active when it returns.
     registerModuleHooks(hooksUrl, { data });

package/dist/internal/cursor-deployment-relay.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Pull relay for `/v0/deployment-events`.
+ *
+ * A {@link RelayAdapter} over {@link CursorRelayCore} — the same engine the
+ * GitHub SCM and Slack relays use, so registration heartbeats, durable
+ * offsets, backoff, and bounded dispatch retry are inherited rather than
+ * reimplemented. Only the subscribe/poll paths, the registration body, and
+ * the per-event filter differ.
+ */
+import type { DeploymentEvent, DeploymentEventType, DeploymentSubscription } from "../channels/deployments/types.js";
+/** One page entry: the event fields plus its stream offset, as the sibling
+ * providers spell it. */
+export type DeploymentRelayEvent = DeploymentEvent & {
+    offset: string;
+};
+export interface ResolvedSubscription {
+    repo: string;
+    environments: string[];
+    events: Set<DeploymentEventType>;
+}
+export interface DeploymentEventRelayOptions {
+    baseUrl: string;
+    apiKey: string;
+    stateDir: string;
+    subscriptions: readonly ResolvedSubscription[];
+    dispatch: (event: DeploymentEvent) => Promise<void>;
+    logger: (line: string) => void;
+    fetchImpl?: typeof fetch;
+    pollWaitMs?: number;
+}
+/** Normalize the channel's `repos` option into concrete subscriptions. */
+export declare function resolveDeploymentSubscriptions(options: {
+    repos: readonly (string | DeploymentSubscription)[];
+    environments?: readonly string[];
+    events?: readonly DeploymentEventType[];
+}): ResolvedSubscription[];
+/** Whether one confirmed subscription wants this event. */
+export declare function deploymentEventMatches(subscription: ResolvedSubscription, envelope: DeploymentEvent): boolean;
+/** One channel the host can deliver a deployment event to. */
+export interface DeploymentDispatchTarget {
+    /** Display name for logs, e.g. `executor/deployments`. */
+    name: string;
+    subscriptions: readonly ResolvedSubscription[];
+    deliver: (event: DeploymentEvent) => Promise<unknown>;
+}
+/**
+ * Deliver one event to every channel subscribed to it.
+ *
+ * Each channel is delivered independently: one channel's handler throwing
+ * must not skip the channels after it, because the relay core retries the
+ * whole dispatch and the channels that already ran would see the event twice.
+ * Throws only when every subscribed channel failed, so a retry cannot
+ * re-deliver to a channel that succeeded.
+ */
+export declare function fanOutDeploymentEvent(input: {
+    targets: readonly DeploymentDispatchTarget[];
+    event: DeploymentEvent;
+    logger: (line: string) => void;
+}): Promise<void>;
+export declare class DeploymentEventRelay {
+    private readonly options;
+    private readonly core;
+    private subscribed;
+    private readonly loggedSkippedRepos;
+    constructor(options: DeploymentEventRelayOptions);
+    /**
+     * Whether an event from this principal's stream belongs to THIS relay.
+     * The stream is per-principal, and one API key can back several relays
+     * (other hosts, or an agent running its own alongside the host's), so each
+     * one re-checks the events against the subscriptions the server confirmed
+     * for it.
+     */
+    private shouldDispatch;
+    start(): void;
+    stop(): Promise<void>;
+}
+//# sourceMappingURL=cursor-deployment-relay.d.ts.map

package/dist/internal/cursor-deployment-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-deployment-relay.d.ts","sourceRoot":"","sources":["../../src/internal/cursor-deployment-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,kCAAkC,CAAC;AAK1C;yBACyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;CAClC;AAQD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IACpD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC,GAAG,oBAAoB,EAAE,CA6CzB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,oBAAoB,EAClC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAQT;AAED,8DAA8D;AAC9D,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC7C,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;AAED,qBAAa,oBAAoB;IAKnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,UAAU,CAA2C;IAC7D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IAExD,YAA6B,OAAO,EAAE,2BAA2B,EAiEhE;IAED;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAsBtB,KAAK,IAAI,IAAI,CAEZ;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1B;CACF"}

package/dist/internal/cursor-deployment-relay.js

@@ -0,0 +1,201 @@
+/**
+ * Pull relay for `/v0/deployment-events`.
+ *
+ * A {@link RelayAdapter} over {@link CursorRelayCore} — the same engine the
+ * GitHub SCM and Slack relays use, so registration heartbeats, durable
+ * offsets, backoff, and bounded dispatch retry are inherited rather than
+ * reimplemented. Only the subscribe/poll paths, the registration body, and
+ * the per-event filter differ.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { CursorRelayCore } from "./cursor-relay-core.js";
+const DEFAULT_EVENTS = ["deployment.succeeded"];
+/** Normalize the channel's `repos` option into concrete subscriptions. */
+export function resolveDeploymentSubscriptions(options) {
+    var _a, _b, _c, _d;
+    const byRepo = new Map();
+    for (const entry of options.repos) {
+        const subscription = typeof entry === "string" ? { repo: entry } : entry;
+        // Case-folded only: `Deployment.repository` has no documented format, and
+        // the server keys subscriptions the same way.
+        const repo = subscription.repo.trim().toLowerCase();
+        if (repo === "") {
+            throw new Error(`deploymentsChannel: invalid repo "${subscription.repo}".`);
+        }
+        const environments = [
+            ...new Set(((_b = (_a = subscription.environments) !== null && _a !== void 0 ? _a : options.environments) !== null && _b !== void 0 ? _b : [])
+                .map((value) => value.trim())
+                .filter(Boolean)),
+        ];
+        const events = new Set((_d = (_c = subscription.events) !== null && _c !== void 0 ? _c : options.events) !== null && _d !== void 0 ? _d : DEFAULT_EVENTS);
+        if (events.size === 0) {
+            throw new Error(`deploymentsChannel: repo "${repo}" subscribes to no events.`);
+        }
+        // Later entries for the same repo widen the earlier one rather than
+        // silently replacing it.
+        const existing = byRepo.get(repo);
+        if (existing === undefined) {
+            byRepo.set(repo, { repo, environments, events });
+            continue;
+        }
+        for (const event of events)
+            existing.events.add(event);
+        existing.environments =
+            existing.environments.length === 0 || environments.length === 0
+                ? []
+                : [...new Set([...existing.environments, ...environments])];
+    }
+    // Empty is legal here and means "this channel wants nothing", which is how
+    // an env-configured channel stays inert without a repo list. The wire-level
+    // empty list means deregister, so the host simply never registers it.
+    return [...byRepo.values()];
+}
+/** Whether one confirmed subscription wants this event. */
+export function deploymentEventMatches(subscription, envelope) {
+    if (!subscription.events.has(envelope.eventType)) {
+        return false;
+    }
+    return (subscription.environments.length === 0 ||
+        subscription.environments.includes(envelope.environment));
+}
+/**
+ * Deliver one event to every channel subscribed to it.
+ *
+ * Each channel is delivered independently: one channel's handler throwing
+ * must not skip the channels after it, because the relay core retries the
+ * whole dispatch and the channels that already ran would see the event twice.
+ * Throws only when every subscribed channel failed, so a retry cannot
+ * re-deliver to a channel that succeeded.
+ */
+export function fanOutDeploymentEvent(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { event, logger } = input;
+        const matched = input.targets.filter((target) => target.subscriptions.some((subscription) => subscription.repo === event.repo &&
+            deploymentEventMatches(subscription, event)));
+        const failures = [];
+        for (const target of matched) {
+            try {
+                yield target.deliver(event);
+            }
+            catch (error) {
+                failures.push(target.name);
+                logger(`[agent-sdk] deployment-events: ${target.name} failed on ${event.eventId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        logger(`[agent-sdk] deployment-events: ${event.eventType} ${event.repo}@${event.sha} (${event.environment}) → ${matched.length - failures.length}/${matched.length} channel(s)`);
+        if (failures.length > 0 && failures.length === matched.length) {
+            throw new Error(`deployment-events: every subscribed channel failed on ${event.eventId} (${failures.join(", ")})`);
+        }
+    });
+}
+export class DeploymentEventRelay {
+    constructor(options) {
+        this.options = options;
+        this.subscribed = new Map();
+        this.loggedSkippedRepos = new Set();
+        const adapter = {
+            logPrefix: "deployment-events",
+            subscribePath: "/v0/deployment-events/subscriptions",
+            pollPath: "/v0/deployment-events",
+            buildRegistrationBody: (consumerId) => ({
+                consumerId,
+                subscriptions: options.subscriptions.map((subscription) => ({
+                    repo: subscription.repo,
+                    environments: subscription.environments,
+                    events: [...subscription.events],
+                })),
+            }),
+            // Empty subscriptions drop this consumer's registration on clean stop
+            // instead of leaving it to lapse by TTL.
+            buildDeregistrationBody: (consumerId) => ({
+                consumerId,
+                subscriptions: [],
+            }),
+            applyRegistrationResponse: (json) => {
+                var _a, _b;
+                const result = json;
+                this.subscribed = new Map();
+                this.loggedSkippedRepos.clear();
+                const lines = [];
+                const confirmed = [];
+                for (const status of (_a = result.repos) !== null && _a !== void 0 ? _a : []) {
+                    const wanted = options.subscriptions.find((subscription) => subscription.repo === status.repo);
+                    if (!status.isSubscribed || wanted === undefined) {
+                        lines.push(`not subscribed to ${status.repo}: ${(_b = status.detail) !== null && _b !== void 0 ? _b : "unknown reason"}`);
+                        continue;
+                    }
+                    this.subscribed.set(status.repo, wanted);
+                    confirmed.push(status.repo);
+                }
+                if (confirmed.length > 0) {
+                    const kinds = [
+                        ...new Set(options.subscriptions.flatMap((s) => [...s.events])),
+                    ];
+                    lines.push(`subscribed to ${confirmed.join(", ")} for events: ${kinds.join(", ")}`);
+                }
+                return lines;
+            },
+            shouldDispatch: (event) => this.shouldDispatch(event),
+            dispatch: (_a) => {
+                var { offset: _offset } = _a, envelope = __rest(_a, ["offset"]);
+                return options.dispatch(envelope);
+            },
+        };
+        this.core = new CursorRelayCore(Object.assign(Object.assign({ baseUrl: options.baseUrl, apiKey: options.apiKey, stateDir: options.stateDir, adapter, logger: options.logger }, (options.fetchImpl === undefined
+            ? {}
+            : { fetchImpl: options.fetchImpl })), (options.pollWaitMs === undefined
+            ? {}
+            : { pollWaitMs: options.pollWaitMs })));
+    }
+    /**
+     * Whether an event from this principal's stream belongs to THIS relay.
+     * The stream is per-principal, and one API key can back several relays
+     * (other hosts, or an agent running its own alongside the host's), so each
+     * one re-checks the events against the subscriptions the server confirmed
+     * for it.
+     */
+    shouldDispatch(event) {
+        const envelope = event;
+        if (envelope === null ||
+            typeof envelope !== "object" ||
+            typeof envelope.repo !== "string") {
+            return false;
+        }
+        const subscription = this.subscribed.get(envelope.repo);
+        if (subscription === undefined) {
+            if (!this.loggedSkippedRepos.has(envelope.repo)) {
+                this.loggedSkippedRepos.add(envelope.repo);
+                this.options.logger(`[agent-sdk] deployment-events: skipping events for ${envelope.repo}: not in this host's subscription (another consumer of this API key likely subscribed it)`);
+            }
+            return false;
+        }
+        return deploymentEventMatches(subscription, envelope);
+    }
+    start() {
+        this.core.start();
+    }
+    stop() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.core.stop();
+        });
+    }
+}

package/dist/internal/deployment-scm-event-stream.js

@@ -42,10 +42,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-// Node builtins only: hosted engines install the consuming agent's directory
-// alone and load this file as raw TypeScript source, so third-party imports
-// (even zod) do not resolve from here. See the tenant-mcp internals for the
-// same constraint.
+// Hosted engines install the consuming agent's directory alone and load this
+// file as raw TypeScript source. Relative and `node:` imports resolve here;
+// this package's own npm dependencies retry against the running `@cursor/july`
+// install (authored-alias-hooks). Do not add deps that package does not have.
 import { createHmac } from "node:crypto";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/internal/distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,sEAAsE;AACtE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CA2BzC,CAAC"}
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,sEAAsE;AACtE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CA4BzC,CAAC"}

package/dist/internal/distribution.js

@@ -81,6 +81,7 @@ export const AUTHORING_ENTRY_FILES = [
     ["channels/slack", "channels/slack/index.js"],
     ["channels/github", "channels/github/index.js"],
     ["channels/origin", "channels/origin/index.js"],
+    ["channels/deployments", "channels/deployments/index.js"],
     ["skills", "skills.js"],
     ["schedules", "schedules.js"],
     ["reminders", "reminders.js"],

package/dist/internal/review-comments.d.ts

@@ -94,6 +94,38 @@ export type GetReviewCommentsArgs = {
 export type ReviewCommentReaderImplementation = {
     getReviewComments: (args: GetReviewCommentsArgs) => Promise<ExistingReviewComment[]>;
 };
+export type ResolveReviewThreadsArgs = {
+    target: ScmReviewTarget;
+    /** REST comment ids whose threads should be resolved. */
+    commentIds: readonly number[];
+    signal?: AbortSignal;
+};
+/**
+ * Outcome of resolving review threads for a set of comment ids. Callers
+ * treat this as best-effort actuation: a failed resolve must not fail the
+ * review that already posted.
+ */
+export type ResolveReviewThreadsResult = {
+    requested: number;
+    resolved: number;
+    alreadyResolved: number;
+    notFound: number;
+    failed: number;
+    detail: string;
+};
+/**
+ * Write side of thread resolution, the counterpart of
+ * {@link ReviewCommentReaderImplementation}. Bugbot's equivalent is
+ * `IGitProvider.resolveReviewThreadForComment` / `resolveThreads`.
+ *
+ * GitHub only exposes resolve via GraphQL (`resolveReviewThread`). REST
+ * has no equivalent. The mutation runs as whatever identity minted the
+ * bound GitHub client — for `githubChannel({ cursorAccount })` that is
+ * the Cursor installation, the same identity that posted the comments.
+ */
+export type ReviewThreadResolverImplementation = {
+    resolveReviewThreadsForComments: (args: ResolveReviewThreadsArgs) => Promise<ResolveReviewThreadsResult>;
+};
 /** Parse a PR URL into the SCM target to read comments from. */
 export declare function resolveScmReviewTarget(prUrl: string): ScmReviewTarget | undefined;
 /**
@@ -105,11 +137,41 @@ export declare function createReviewCommentReader(args: {
     target: ScmReviewTarget;
     github?: HostGitHubClient;
 }): ReviewCommentReaderImplementation | undefined;
+/**
+ * Resolver for a resolved target. Returns undefined when the host cannot
+ * serve that provider, so callers degrade instead of throwing.
+ */
+export declare function createReviewThreadResolver(args: {
+    target: ScmReviewTarget;
+    github?: HostGitHubClient;
+}): ReviewThreadResolverImplementation | undefined;
+/**
+ * Resolve the review threads that own `commentIds` on `prUrl`.
+ *
+ * No-ops (never throws) when the PR is on an SCM this host cannot write,
+ * no client is bound, or `commentIds` is empty. Same degrade-don't-fail
+ * posture as {@link createReviewCommentReader}.
+ */
+export declare function resolveReviewThreadsForComments(args: {
+    prUrl: string;
+    commentIds: readonly number[];
+    github?: HostGitHubClient;
+    resolver?: ReviewThreadResolverImplementation;
+    signal?: AbortSignal;
+}): Promise<ResolveReviewThreadsResult>;
 /**
  * Reads inline review comments through the host GitHub client (Cursor
  * account lease, App installation token, or PAT).
  */
 export declare function createHostGithubReviewCommentReader(github: HostGitHubClient): ReviewCommentReaderImplementation;
+/**
+ * Resolves inline review threads through the host GitHub client (Cursor
+ * account lease, App installation token, or PAT). GitHub GraphQL has no
+ * comment→thread field, so this pages the PR's review threads and matches
+ * each REST comment id by `databaseId` — the same approach as Bugbot's
+ * `resolveReviewThreadForComment`.
+ */
+export declare function createHostGithubReviewThreadResolver(github: HostGitHubClient): ReviewThreadResolverImplementation;
 type GithubReviewCommentLike = {
     id: number;
     path: string;

package/dist/internal/review-comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iBAAiB,EAAE,CACjB,IAAI,EAAE,qBAAqB,KACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,SAAS,CAS7B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,iCAAiC,GAAG,SAAS,CAOhD;AAMD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,gBAAgB,GACvB,iCAAiC,CA6BnC;AAED,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,GAAG,SAAS,CAoBnC;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC"}
+{"version":3,"file":"review-comments.d.ts","sourceRoot":"","sources":["../../src/internal/review-comments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,sBAAsB,CAAC;IAClC,IAAI,EAAE,6BAA6B,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACxC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,UAAU,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,mDAAmD;AACnD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C,iBAAiB,EAAE,CACjB,IAAI,EAAE,qBAAqB,KACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,eAAe,CAAC;IACxB,yDAAyD;IACzD,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,kCAAkC,GAAG;IAC/C,+BAA+B,EAAE,CAC/B,IAAI,EAAE,wBAAwB,KAC3B,OAAO,CAAC,0BAA0B,CAAC,CAAC;CAC1C,CAAC;AAEF,gEAAgE;AAChE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,eAAe,GAAG,SAAS,CAS7B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,iCAAiC,GAAG,SAAS,CAOhD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GAAG,kCAAkC,GAAG,SAAS,CAOjD;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CAAC,IAAI,EAAE;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,CAAC,EAAE,kCAAkC,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAsBtC;AASD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,gBAAgB,GACvB,iCAAiC,CA6BnC;AA2BD;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,gBAAgB,GACvB,kCAAkC,CAkHpC;AAkCD,KAAK,uBAAuB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,GAAG,SAAS,CAoBnC;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,qBAAqB,GAEzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,qBAAqB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,oCAAoC,CAMnF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,gBAAgB,GACvB,oCAAoC,CAMtC"}