@cursor/july 0.1.92 → 0.1.94

package/dist/internal/discovery.js

@@ -31,7 +31,7 @@ import { pathToFileURL } from "node:url";
 import { resolveABMaxPlaygroundSessions } from "../ab.js";
 import { resolveArtifactsMax } from "../artifacts.js";
 import { httpChannel } from "../channels.js";
-import { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, isInlineStdioConnection, MAX_RUNNING_TURNS_LIMIT, normalizeCursorAccountServers, toPublicCloudInfo, } from "../types.js";
+import { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, isInlineStdioConnection, isToolEffect, MAX_RUNNING_TURNS_LIMIT, normalizeConnectionEffects, normalizeCursorAccountServers, toPublicCloudInfo, } from "../types.js";
 import { registerAuthoredModuleLoaders } from "./authored-loaders.js";
 import { normalizePositiveInt } from "./bounded-int.js";
 import { getDefinitionKind } from "./brand.js";
@@ -306,11 +306,12 @@ function loadAgent(ctx, agentDir, options) {
             }
             return Object.assign(Object.assign(Object.assign(Object.assign({ name }, ((config === null || config === void 0 ? void 0 : config.description) === undefined
                 ? {}
-                : { description: config.description })), ((config === null || config === void 0 ? void 0 : config.model) === undefined ? {} : { model: config.model })), (instructions === undefined ? {} : { instructions })), { runtime: "local", tools: [], skills: [], connections: [], subagents: [], seedFiles: [] });
+                : { description: config.description })), ((config === null || config === void 0 ? void 0 : config.model) === undefined ? {} : { model: config.model })), (instructions === undefined ? {} : { instructions })), { runtime: "local", tools: [], skills: [], connections: [], hostConnections: [], subagents: [], seedFiles: [] });
         }
         const tools = yield loadTools(ctx, join(agentDir, "tools"));
         const skills = yield loadSkills(ctx, join(agentDir, "skills"));
         const connections = yield loadConnections(ctx, yield resolveMcpConnectionsDir(ctx, agentDir));
+        const hostConnections = yield loadHostConnections(ctx, agentDir, connections);
         const seedFiles = yield loadSeedFiles(ctx, agentDir);
         const subagents = yield loadSubagents(ctx, join(agentDir, "subagents"));
         const runtime = resolveRuntime(ctx, agentDir, config === null || config === void 0 ? void 0 : config.runtime);
@@ -415,7 +416,7 @@ function loadAgent(ctx, agentDir, options) {
                 agentTools: tools.filter((tool) => tool.execution === "agent").length,
                 skills: skills.length,
                 seedFiles: seedFiles.length,
-                connections: connections.length,
+                connections: connections.length + hostConnections.length,
                 subagents: subagents.length,
                 hasCloudOptions: cloud !== undefined,
                 hasLocalSandbox: localSandbox,
@@ -430,6 +431,7 @@ function loadAgent(ctx, agentDir, options) {
             concurrency }), (architecture === undefined ? {} : { architecture })), { tools,
             skills,
             connections,
+            hostConnections,
             subagents,
             seedFiles });
     });
@@ -904,6 +906,23 @@ function hasAuthorizationHeader(headers) {
     }
     return Object.keys(headers).some((key) => key.toLowerCase() === "authorization");
 }
+function parseConnectionEffects(effects) {
+    if (effects === undefined) {
+        return { ok: true, value: undefined };
+    }
+    const raw = typeof effects === "string" ? [effects] : effects;
+    if (!Array.isArray(raw) || raw.length === 0) {
+        return { ok: false };
+    }
+    const parsed = [];
+    for (const value of raw) {
+        if (!isToolEffect(value)) {
+            return { ok: false };
+        }
+        parsed.push(value);
+    }
+    return { ok: true, value: normalizeConnectionEffects(parsed) };
+}
 function connectionHasSpawnOrRemote(connection) {
     if ("cursorAccount" in connection && connection.cursorAccount === true) {
         return true;
@@ -1002,6 +1021,42 @@ function resolveMcpConnectionsDir(ctx, agentDir) {
         return preferred;
     });
 }
+function loadHostConnections(ctx, agentDir, modelConnections) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const hostDir = join(agentDir, "host-connections");
+        const loaded = yield loadConnections(ctx, hostDir);
+        const modelNames = new Set(modelConnections.map((connection) => connection.name));
+        const hostConnections = [];
+        for (const connection of loaded) {
+            if (modelNames.has(connection.name)) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: `Host connection "${connection.name}" collides with agent/mcp-connections/${connection.name}. Rename one of them.`,
+                });
+                continue;
+            }
+            if (connection.advertiseTools === true) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: "Host connections are off the model. `advertiseTools` cannot apply. Drop it.",
+                });
+                continue;
+            }
+            if (connection.auth !== undefined) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, join(hostDir, `${connection.name}.ts`)),
+                    message: "Host connections are off the model. `auth` cannot apply. Use static headers or `oauth: true`.",
+                });
+                continue;
+            }
+            hostConnections.push(connection);
+        }
+        return hostConnections;
+    });
+}
 function loadConnections(ctx, connectionsDir) {
     return __awaiter(this, void 0, void 0, function* () {
         if (!(yield isDirectory(connectionsDir))) {
@@ -1027,6 +1082,14 @@ function loadConnections(ctx, connectionsDir) {
                 continue;
             }
             const connection = definition;
+            if (Object.hasOwn(connection, "hostOnly")) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, entryPath),
+                    message: "MCP connection `hostOnly` was removed. Files under `agent/mcp-connections/` are always visible to the model. Put privileged servers in `agent/host-connections/` so only host tools can call them.",
+                });
+                continue;
+            }
             if (isInlineStdioConnection(connection) &&
                 connectionHasSpawnOrRemote(connection)) {
                 ctx.diagnostics.push({
@@ -1062,20 +1125,30 @@ function loadConnections(ctx, connectionsDir) {
                 });
                 continue;
             }
-            if (connection.advertiseTools === true &&
-                isInlineStdioConnection(connection)) {
+            const parsedEffects = parseConnectionEffects(connection.effects);
+            if (!parsedEffects.ok) {
                 ctx.diagnostics.push({
                     severity: "error",
                     path: displayPath(ctx, entryPath),
-                    message: "MCP connection `advertiseTools` is not supported on inline `tools` connections — author those as agent/tools/ server tools instead.",
+                    message: 'MCP connection `effects` must be "read", "write", or a non-empty array of those.',
                 });
                 continue;
             }
-            if (connection.advertiseTools === true && connection.hostOnly === true) {
+            if (parsedEffects.value !== undefined &&
+                connection.advertiseTools !== true) {
                 ctx.diagnostics.push({
                     severity: "error",
                     path: displayPath(ctx, entryPath),
-                    message: "MCP connection `advertiseTools` puts the connection's tools in the model's toolset, which contradicts `hostOnly` (off the model entirely). Drop one of them.",
+                    message: "MCP connection `effects` filters advertised tools; set `advertiseTools: true` or drop `effects`.",
+                });
+                continue;
+            }
+            if (connection.advertiseTools === true &&
+                isInlineStdioConnection(connection)) {
+                ctx.diagnostics.push({
+                    severity: "error",
+                    path: displayPath(ctx, entryPath),
+                    message: "MCP connection `advertiseTools` is not supported on inline `tools` connections — author those as agent/tools/ server tools instead.",
                 });
                 continue;
             }
@@ -1149,9 +1222,9 @@ function loadConnections(ctx, connectionsDir) {
                 name,
                 transport,
                 description: connection.description,
-                hostOnly: connection.hostOnly,
                 auth: connection.auth,
                 advertiseTools: connection.advertiseTools,
+                effects: parsedEffects.value,
             });
         }
         return connections;
@@ -1207,7 +1280,6 @@ function loadInlineStdioConnection(ctx, name, entryPath, connection) {
                 name,
                 transport,
                 description: connection.description,
-                hostOnly: connection.hostOnly,
             };
         }
         catch (error) {
@@ -1253,6 +1325,7 @@ function warnUnsupportedSubagentSlots(ctx, subagentDir) {
             ["tools", "tools"],
             ["skills", "skills"],
             ["mcp-connections", "MCP connections"],
+            ["host-connections", "host MCP connections"],
             ["connections", "MCP connections"],
             ["subagents", "nested subagents"],
             ["channels", "channels"],
@@ -1331,7 +1404,7 @@ function checkGrokBotRuntimeLimitations(ctx, agentDir, counts) {
         error(displayPath(ctx, join(agentDir, "tools")), 'Server tools (execution: "server", including opted-in builtinTools) are not reachable from grokbot turns yet. Remove them or run the agent on the local runtime.');
     }
     if (counts.connections > 0) {
-        error(displayPath(ctx, join(agentDir, "mcp-connections")), "MCP connections are not wired into grokbot turns yet. Remove them or run the agent on the local runtime.");
+        error(displayPath(ctx, agentDir), "MCP connections (agent/mcp-connections/ or agent/host-connections/) are not wired into grokbot turns yet. Remove them or run the agent on the local runtime.");
     }
     if (counts.subagents > 0) {
         error(displayPath(ctx, join(agentDir, "subagents")), "Authored subagents are not available on grokbot turns (the Grok Bot harness runs its own subagent set). Remove them or run the agent on the local runtime.");
@@ -1814,6 +1887,7 @@ export function projectInfo(project) {
             description: tool.description,
             execution: tool.execution,
             needsApproval: tool.needsApproval,
+            effect: tool.effect,
             inputSchema: tool.inputSchema,
         })), skills: agent.skills.map((skill) => ({
             name: skill.name,
@@ -1821,8 +1895,8 @@ export function projectInfo(project) {
         })), connections: agent.connections.map((connection) => { var _a; return ({
             name: connection.name,
             transport: connectionTransportLabel(connection.transport),
-            hostOnly: connection.hostOnly,
             advertiseTools: connection.advertiseTools,
+            effects: connection.effects,
             cursorAccountServers: "cursorAccount" in connection.transport
                 ? ((_a = connection.transport.servers) !== null && _a !== void 0 ? _a : "*")
                 : undefined,
@@ -1864,6 +1938,9 @@ export function projectInfo(project) {
                 if ((meta === null || meta === void 0 ? void 0 : meta.originWebhookEvents) !== undefined) {
                     info.originWebhookEvents = meta.originWebhookEvents;
                 }
+                if ((meta === null || meta === void 0 ? void 0 : meta.deploymentEventTypes) !== undefined) {
+                    info.deploymentEventTypes = meta.deploymentEventTypes;
+                }
                 if ((meta === null || meta === void 0 ? void 0 : meta.slackChannelPosts) !== undefined) {
                     info.slackChannelPosts = meta.slackChannelPosts;
                 }
@@ -1951,6 +2028,7 @@ function warnUnknownSlots(ctx, agentDir) {
             "tools",
             "skills",
             "mcp-connections",
+            "host-connections",
             // Legacy slot name; resolveMcpConnectionsDir warns and still loads it.
             "connections",
             "subagents",
@@ -1960,7 +2038,7 @@ function warnUnknownSlots(ctx, agentDir) {
             "ab",
             "sandbox",
             "lib",
-            // Vite playground custom tool chips (examples/*/agent/playground/tools).
+            // Vite playground custom tool chips (agent/playground/tools).
             "playground",
         ]);
         for (const entry of yield sortedEntries(agentDir)) {

package/dist/internal/distribution.d.ts

@@ -14,8 +14,9 @@ export declare const PACKAGE_NAME = "@cursor/july";
 /** Historical monorepo package name; never published, aliased at runtime. */
 export declare const LEGACY_PACKAGE_NAME = "@anysphere/agent-serve";
 /**
- * Future public package name; aliased with the same fallback-only semantics
- * as PACKAGE_NAME so the eventual rename keeps authored imports working.
+ * Future public package name; aliased with the same direct-to-running-dist
+ * semantics as PACKAGE_NAME so the eventual rename keeps authored imports
+ * on the CLI's module identity.
  */
 export declare const AGENTKIT_PACKAGE_NAME = "@cursor/agentkit";
 /**
@@ -67,7 +68,7 @@ export declare function formatCliVersion(options?: {
  * runtime mirror of the package `exports` map (the source of truth;
  * `authored-loaders.test.ts` asserts they stay identical). The alias hooks
  * derive `@anysphere/agent-serve[/x]`, `@cursor/july[/x]`, and
- * `@cursor/agentkit[/x]` targets from this list.
+ * `@cursor/agentkit[/x]` direct targets from this list.
  */
 export declare const AUTHORING_ENTRY_FILES: ReadonlyArray<readonly [subpath: string, file: string]>;
 //# sourceMappingURL=distribution.d.ts.map

package/dist/internal/distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,sEAAsE;AACtE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,cAAc,IAAI,cAAc,CAM/C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAMrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CA2BzC,CAAC"}
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../src/internal/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,sEAAsE;AACtE,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,eAAO,MAAM,UAAU,EAAE,MAA2B,CAAC;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAAiC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAA+B,CAAC;AAc/D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,cAAc,IAAI,cAAc,CAM/C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAMrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,aAAa,CAC/C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CA2BzC,CAAC"}

package/dist/internal/distribution.js

@@ -17,8 +17,9 @@ export const PACKAGE_NAME = "@cursor/july";
 /** Historical monorepo package name; never published, aliased at runtime. */
 export const LEGACY_PACKAGE_NAME = "@anysphere/agent-serve";
 /**
- * Future public package name; aliased with the same fallback-only semantics
- * as PACKAGE_NAME so the eventual rename keeps authored imports working.
+ * Future public package name; aliased with the same direct-to-running-dist
+ * semantics as PACKAGE_NAME so the eventual rename keeps authored imports
+ * on the CLI's module identity.
  */
 export const AGENTKIT_PACKAGE_NAME = "@cursor/agentkit";
 /**
@@ -91,7 +92,7 @@ export function formatCliVersion(options) {
  * runtime mirror of the package `exports` map (the source of truth;
  * `authored-loaders.test.ts` asserts they stay identical). The alias hooks
  * derive `@anysphere/agent-serve[/x]`, `@cursor/july[/x]`, and
- * `@cursor/agentkit[/x]` targets from this list.
+ * `@cursor/agentkit[/x]` direct targets from this list.
  */
 export const AUTHORING_ENTRY_FILES = [
     ["", "index.js"],

package/dist/internal/hosted-delivery-protocol.d.ts

@@ -0,0 +1,38 @@
+export declare const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
+export declare const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
+export declare const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
+export declare const HOSTED_EXECUTION_PATH = "/v1/internal/hosted-execution";
+export type HostedAdmission = {
+    v: 2;
+    channelId: string;
+    channelKind: "github";
+    eventType: string;
+    deliveryId: string;
+    sessionMode: "event" | "continuation";
+    mailboxContinuationKey: string;
+    payload: unknown;
+};
+export type HostedAdmissionOutcome = {
+    ok: true;
+    v: 2;
+    outcome: "skip" | "task";
+} | {
+    ok: true;
+    v: 2;
+    outcome: "send";
+    admissionToken: string;
+};
+export type HostedExecution = {
+    v: 2;
+    admissionToken: string;
+    sessionPublicId: string;
+};
+export type HostedExecutionOutcome = {
+    ok: true;
+    v: 2;
+    outcome: "send";
+};
+export declare function parseHostedAdmission(value: unknown): HostedAdmission | undefined;
+export declare function parseHostedExecution(value: unknown): HostedExecution | undefined;
+export declare function parseHostedAdmissionOutcome(value: unknown): HostedAdmissionOutcome | undefined;
+//# sourceMappingURL=hosted-delivery-protocol.d.ts.map

package/dist/internal/hosted-delivery-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-delivery-protocol.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery-protocol.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAClD,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AACrE,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,QAAQ,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC;IACtC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,CAAC,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,IAAI,CAAC;IACT,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAkBF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAsB7B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,eAAe,GAAG,SAAS,CAe7B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,sBAAsB,GAAG,SAAS,CAkBpC"}

package/dist/internal/hosted-delivery-protocol.js

@@ -0,0 +1,70 @@
+export const HOSTED_DELIVERY_PROTOCOL_VERSION = 2;
+export const HOSTED_DELIVERY_HEADER = "x-agent-sdk-hosted-delivery";
+export const HOSTED_ADMISSION_PATH = "/v1/internal/hosted-admission";
+export const HOSTED_EXECUTION_PATH = "/v1/internal/hosted-execution";
+const DELIVERY_KEYS = new Set([
+    "v",
+    "channelId",
+    "channelKind",
+    "eventType",
+    "deliveryId",
+    "sessionMode",
+    "mailboxContinuationKey",
+    "payload",
+]);
+const EXECUTION_KEYS = new Set(["v", "admissionToken", "sessionPublicId"]);
+function boundedString(value, max) {
+    return typeof value === "string" && value.length > 0 && value.length <= max;
+}
+export function parseHostedAdmission(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const body = value;
+    if (Object.keys(body).some((key) => !DELIVERY_KEYS.has(key)) ||
+        !Object.hasOwn(body, "payload") ||
+        body.v !== HOSTED_DELIVERY_PROTOCOL_VERSION ||
+        !boundedString(body.channelId, 128) ||
+        body.channelKind !== "github" ||
+        !boundedString(body.eventType, 128) ||
+        !boundedString(body.deliveryId, 256) ||
+        (body.sessionMode !== "event" && body.sessionMode !== "continuation") ||
+        !boundedString(body.mailboxContinuationKey, 512)) {
+        return undefined;
+    }
+    const prefix = body.sessionMode === "event" ? "evt:" : "cont:";
+    return body.mailboxContinuationKey.startsWith(prefix)
+        ? body
+        : undefined;
+}
+export function parseHostedExecution(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const body = value;
+    if (Object.keys(body).some((key) => !EXECUTION_KEYS.has(key)) ||
+        body.v !== HOSTED_DELIVERY_PROTOCOL_VERSION ||
+        !boundedString(body.admissionToken, 128) ||
+        typeof body.sessionPublicId !== "string" ||
+        !/^ses_[a-f0-9]{24}$/.test(body.sessionPublicId)) {
+        return undefined;
+    }
+    return body;
+}
+export function parseHostedAdmissionOutcome(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const body = value;
+    if (body.ok !== true ||
+        body.v !== HOSTED_DELIVERY_PROTOCOL_VERSION ||
+        (body.outcome !== "skip" &&
+            body.outcome !== "send" &&
+            body.outcome !== "task")) {
+        return undefined;
+    }
+    if (body.outcome === "send" && !boundedString(body.admissionToken, 128)) {
+        return undefined;
+    }
+    return body;
+}

package/dist/internal/hosted-delivery.d.ts

@@ -0,0 +1,35 @@
+import type { ChannelHandlerArgs, SendMessageOptions } from "../types.js";
+import { type HostedAdmission } from "./hosted-delivery-protocol.js";
+import type { Router } from "./router.js";
+type DispatchInput = {
+    delivery: HostedAdmission;
+    definition: object;
+    args: ChannelHandlerArgs;
+};
+type PendingSend = {
+    channelId: string;
+    message: string;
+    options: SendMessageOptions;
+    mailboxContinuationKey: string;
+};
+type AdmissionDispatch = {
+    response: Response;
+    pendingSend?: PendingSend;
+};
+/**
+ * Run authored admission without creating a framework session. V1 GitHub
+ * `task` callbacks execute as sessionless work; `send` is captured and
+ * resumed only after the control plane allocates `ses_…`.
+ */
+export declare function dispatchHostedAdmission(input: DispatchInput): Promise<AdmissionDispatch>;
+export declare function registerHostedDeliveryRoute(input: {
+    router: Router;
+    base: string;
+    channels: Array<{
+        id: string;
+        definition: object;
+    }>;
+    buildHandlerArgs(channelId: string, sessionPublicId?: string): ChannelHandlerArgs;
+}): void;
+export {};
+//# sourceMappingURL=hosted-delivery.d.ts.map

package/dist/internal/hosted-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-delivery.d.ts","sourceRoot":"","sources":["../../src/internal/hosted-delivery.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,eAAe,EAGrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,aAAa,GAAG;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAgBF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA2G5B;AAeD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,GACvB,kBAAkB,CAAC;CACvB,GAAG,IAAI,CAqKP"}