@cursor/july 0.1.95 → 0.1.97

package/AGENTS.md

@@ -33,9 +33,9 @@ built-in read/grep fail and sends models into retry loops.
 Before scaffolding, wiring channels, writing evals, or deploying, **read the
 matching skill under `skills/<task>/SKILL.md`** (paths
 below are relative to this package). Those files ship with `@cursor/july`.
-Cloud agents get the same published skills (except `operate`) via
-`GetManagedSkills`, which reads these files. Open them directly — there
-are no `.cursor/skills/` stubs for authoring.
+Cloud agents get the same published skills via `GetManagedSkills`,
+which reads these files. Open them directly. There are no
+`.cursor/skills/` stubs for authoring.
 
 | Skill | Read it when |
 | --- | --- |
@@ -49,7 +49,6 @@ are no `.cursor/skills/` stubs for authoring.
 | `skills/setup-slack/SKILL.md` | Slack wiring and Slack tool approvals |
 | `skills/mcp-auth/SKILL.md` | Host MCP OAuth (`mcp oauth`, `--store`, `advertiseTools`, `host-connections/`) |
 | `skills/debug/SKILL.md` | Something misbehaving locally (symptom → cause) |
-| `skills/operate/SKILL.md` | Dogfood host, corp ECS, hosted-platform map |
 
 Hosted-platform debug (stopped / slow start / health-fail, Datadog
 `cursor.agent_serve.*`) is the monorepo skill

package/README.md

@@ -620,8 +620,9 @@ info and materialized workspace, and the call is recorded on the
 session's event stream as `actions.requested` / `action.result` under a
 per-call `turnId`. That call is visible in the playground, NDJSON
 trace, and trajectories like any model-initiated call. Session-bound
-calls are serialized with model turns: while a turn is running the call
-is rejected with `409 session_busy`.
+writes are serialized with model turns: while a turn is running a
+write-effect call is rejected with `409 session_busy`, while a
+read-effect call runs alongside the turn.
 
 Unknown tools are rejected with the available tool names, `execution:
 "agent"` tools cannot be called on the host (400), schema-invalid input is a

package/dist/bin/agent-serve.js

@@ -104,7 +104,7 @@ Usage:
   ${CLI} deploy      [--dir <path>] [--slug <slug> | --all] [--team <id>] [--json]
                           [--no-wait] [--repo <url>] [--ref <ref>]
                           [--path <agentPath>] [--cursor-events-repo <owner/name>]...
-                          [--allow-domain <domain>]...
+                          [--allow-domain <domain>]... [--multi-tenant]
   ${CLI} manifest    [--dir <path>] [--json]
   ${CLI} deployments [--team <id>] [--json]
   ${CLI} deployment  <slug> [--team <id>] [--json]
@@ -232,6 +232,8 @@ Commands:
               (flags always win). When --dir is a multi-agent parent,
               pick one interactively, or pass --slug / --all. First deploy
               of a slug prints the alias token exactly once — save it.
+              --multi-tenant adds a release to an existing Cursor-managed
+              product (v2 only); it cannot create a new multi-tenant app.
   deployments List the team's deployments (slug, status, generation, kind).
   deployment  Show one deployment in full (status, lastError, engine info).
   stop        Stop a deployment and wait until it reports stopped.
@@ -394,6 +396,9 @@ Options:
   --allow-domain     deploy: egress domain the engine pod may reach
                      (repeatable; unioned with hosting.egressDomains from the
                      agent manifest). Repo-backed deploys only.
+  --multi-tenant     deploy: add a release to an existing Cursor-managed
+                     (multi-tenant) product. architecture v2 only. Cannot
+                     create a new multi-tenant application.
   --from-argv        secrets set: allow NAME=VALUE on argv (leaks into shell
                      history and agent-captured terminals). Default is names
                      only with a hidden prompt or piped stdin.
@@ -403,6 +408,8 @@ Options:
                      GITHUB_WEBHOOK_SECRET). github: --events overrides the
                      derived webhook event list.
   --install          github: install the cli/gh-webhook extension if missing.
+                     slack init --manual: require Slack CLI app install.
+  --no-install       slack init --manual: skip Slack CLI app install.
   --action           github replay: event action (e.g. opened, synchronize).
   --conclusion       github replay: CI conclusion (check_run/suite/status).
   --comment          github replay: comment body for comment events.
@@ -517,6 +524,7 @@ function main(argv) {
                 secret: { type: "string" },
                 channel: { type: "string", multiple: true },
                 install: { type: "boolean", default: false },
+                "no-install": { type: "boolean", default: false },
                 action: { type: "string" },
                 conclusion: { type: "string" },
                 context: { type: "string" },
@@ -530,6 +538,7 @@ function main(argv) {
                 all: { type: "boolean", default: false },
                 "cursor-events-repo": { type: "string", multiple: true },
                 "allow-domain": { type: "string", multiple: true },
+                "multi-tenant": { type: "boolean", default: false },
                 "from-argv": { type: "boolean", default: false },
                 strict: { type: "boolean", default: false },
                 junit: { type: "string" },
@@ -577,6 +586,8 @@ function main(argv) {
                     icon: values.icon,
                     force: values.force,
                     manual: values.manual,
+                    install: values.install,
+                    noInstall: values["no-install"],
                     iconSource: positionals[0] === "icon" ? positionals[1] : undefined,
                 });
             }
@@ -684,11 +695,11 @@ function main(argv) {
                 // `--repo` is repeatable for `serve --cursor-events`; deploy targets a
                 // single source repo, so the last one wins.
                 const repo = (_c = values.repo) === null || _c === void 0 ? void 0 : _c.at(-1);
-                return cmdDeploy(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, deployOptionsFromValues(values)), { dir }), (values.slug === undefined ? {} : { slug: values.slug })), { all: values.all === true }), (repo === undefined ? {} : { repo })), (values.ref === undefined ? {} : { ref: values.ref })), (values.path === undefined ? {} : { path: values.path })), (values["cursor-events-repo"] === undefined
+                return cmdDeploy(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, deployOptionsFromValues(values)), { dir }), (values.slug === undefined ? {} : { slug: values.slug })), { all: values.all === true }), (repo === undefined ? {} : { repo })), (values.ref === undefined ? {} : { ref: values.ref })), (values.path === undefined ? {} : { path: values.path })), (values["cursor-events-repo"] === undefined
                     ? {}
                     : { cursorEventsRepos: values["cursor-events-repo"] })), (values["allow-domain"] === undefined
                     ? {}
-                    : { allowDomains: values["allow-domain"] })));
+                    : { allowDomains: values["allow-domain"] })), { multiTenant: values["multi-tenant"] === true }));
             }
             case "manifest": {
                 // Offline extraction of deploy metadata (events, egress, routes,

package/dist/channels/deployments/types.d.ts

@@ -2,7 +2,7 @@ import type { ContinuationIdentity } from "../../continuation.js";
 import type { ChannelDefinition, ChannelHandlerArgs } from "../../types.js";
 /** {@link ChannelMeta.kind} value used by {@link deploymentsChannel}. */
 export declare const DEPLOYMENTS_CHANNEL_KIND = "deployments";
-export declare const DEPLOYMENT_EVENT_TYPES: readonly ["deployment.created", "deployment.succeeded"];
+export declare const DEPLOYMENT_EVENT_TYPES: readonly ["deployment.created", "deployment.succeeded", "deployment.failed"];
 export type DeploymentEventType = (typeof DEPLOYMENT_EVENT_TYPES)[number];
 export type DeploymentStatus = "pending" | "in_progress" | "success" | "failed";
 /** One deployment event, as the control plane records it. */

package/dist/channels/deployments/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/deployments/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,sBAAsB,CACd,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,OAAO,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/deployments/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE5E,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,YACjC,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,CACX,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,sBAAsB,CAAC,EAAE,CAAC;IAC/D;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,6EAA6E;IAC7E,OAAO,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,kBAAkB,KACrB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChC,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}

package/dist/channels/deployments/types.js

@@ -3,4 +3,5 @@ export const DEPLOYMENTS_CHANNEL_KIND = "deployments";
 export const DEPLOYMENT_EVENT_TYPES = [
     "deployment.created",
     "deployment.succeeded",
+    "deployment.failed",
 ];

package/dist/channels/origin/api.d.ts

@@ -1,18 +1,24 @@
 /**
  * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
  *
- * Origin writes such as CI check runs are installation-only: they need an
- * `oit_…` installation token minted from Origin app credentials (EdDSA app
- * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
- * consolidates that flow so agents configure credentials once and call
- * {@link createOriginClient} — the GitHub-channel analogue of
+ * This module consolidates Origin auth so agents configure credentials once
+ * and call {@link createOriginClient} — the GitHub-channel analogue of
  * `createGitHubOctokit`.
  *
- * Credentials resolve from options first, then the environment:
- * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
- * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
- * app's Ed25519 key; literal `\n` sequences are normalized), and
- * `ORIGIN_API_BASE_URL` for the public REST base.
+ * Self-configured channels with their own Origin app resolve credentials
+ * from options first, then the environment: `ORIGIN_APP_ID` (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`), `ORIGIN_APP_INSTALLATION_ID`,
+ * `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the app's Ed25519 key; literal
+ * `\n` sequences are normalized), `ORIGIN_API_BASE_URL` for the public REST
+ * base, and `ORIGIN_RPC_BASE_URL` for the first-party ConnectRPC base.
+ *
+ * Hosted v2 forks configure none of that: their only credential is the
+ * deployment service account's `CURSOR_API_KEY`, exchanged for a Cursor
+ * session ({@link cursorSessionTokenProvider}, `POST
+ * /auth/exchange_user_api_key`) and sent as the Origin bearer. Reads and
+ * writes both run as the deployment **service-account principal**; Origin's
+ * `agent-serve` allowlist grants team-namespace read/write, so there is no
+ * app-installation token exchange for managed deployments.
  */
 /**
  * Public Origin REST base (check runs, installation tokens). Distinct from
@@ -20,6 +26,14 @@
  * `origin-webhook.ts`).
  */
 export declare const DEFAULT_ORIGIN_PUBLIC_API_BASE_URL = "https://api.cursor.com";
+/**
+ * Origin's first-party ConnectRPC host (`origin.v1.OriginService`). Separate
+ * deployment from {@link DEFAULT_ORIGIN_PUBLIC_API_BASE_URL}: a handful of
+ * workflow operations — comment reactions among them — have no
+ * `/v1/origin/...` REST binding yet and are only reachable as Connect unary
+ * JSON here.
+ */
+export declare const DEFAULT_ORIGIN_RPC_BASE_URL = "https://api.origin.cursor.com";
 export type OriginApiMethod = "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
 /** Normalized Origin REST failure — the `GitHubApiError` analogue. */
 export declare class OriginApiError extends Error {
@@ -34,7 +48,10 @@ export declare class OriginApiError extends Error {
         status: number;
     });
 }
-/** Yields a bearer for Origin REST calls (usually a short-lived `oit_…`). */
+/**
+ * Yields a bearer for Origin REST calls (a short-lived `oit_…` for app
+ * channels, or a Cursor session token for service-account access).
+ */
 export type OriginTokenProvider = () => Promise<string>;
 export interface OriginAppCredentials {
     /** Origin app id (`app_<typeid>`). */
@@ -54,6 +71,32 @@ export declare function resolveOriginAppCredentialParts(env?: NodeJS.ProcessEnv)
 export declare function resolveOriginAppCredentials(env?: NodeJS.ProcessEnv): OriginAppCredentials | undefined;
 /** Public Origin REST base. Trailing slashes are stripped for path joins. */
 export declare function originPublicApiBaseUrl(env?: NodeJS.ProcessEnv): string;
+/** Origin ConnectRPC base. Trailing slashes are stripped for path joins. */
+export declare function originRpcBaseUrl(env?: NodeJS.ProcessEnv): string;
+/**
+ * Exchange endpoint for Cursor-account session tokens. Override with
+ * `AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL`; defaults to the Cursor backend.
+ */
+export declare function resolveCursorSessionExchangeUrl(): string;
+/**
+ * A session-backed Origin token provider: {@link OriginTokenProvider} plus
+ * an `invalidate` hook `createOriginClient` calls when Origin rejects the
+ * bearer (401), so the next mint re-exchanges instead of serving the
+ * rejected session until its local renewal deadline.
+ */
+export type CursorSessionTokenProvider = OriginTokenProvider & {
+    invalidate: (token: string) => void;
+};
+/** Test-only: drop the process-wide exchanged-session cache. */
+export declare function _clearCursorSessionTokenCacheForTesting(): void;
+export declare function cursorSessionTokenProvider(input?: {
+    /** Cursor API key source. Defaults to the standard host resolution. */
+    getApiKey?: () => string | undefined;
+    /** Exchange endpoint. Defaults to {@link resolveCursorSessionExchangeUrl}. */
+    exchangeUrl?: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): CursorSessionTokenProvider;
 /**
  * A cached per-use token provider for one set of app credentials. Every call
  * inside the reuse window returns the same `oit_…`; the first call after it
@@ -70,13 +113,24 @@ export interface OriginClientOptions {
     token?: string | OriginTokenProvider;
     /**
      * App credentials to mint installation tokens from. Defaults to the
-     * environment ({@link resolveOriginAppCredentials}).
+     * environment ({@link resolveOriginAppCredentials}). Pass `false` to
+     * disable app credential lookup and force the Cursor-account exchange.
      */
-    credentials?: OriginAppCredentials;
+    credentials?: OriginAppCredentials | false;
     /** Public Origin REST base. Defaults to `ORIGIN_API_BASE_URL` / prod. */
     apiBaseUrl?: string;
     /** Injectable fetch for tests. */
     fetch?: typeof fetch;
+    /**
+     * Cursor-account session exchange fallback (hosted v2 deployment SAs and
+     * local personal keys). `true` (default) engages when no explicit token
+     * or app credentials resolve and a Cursor credential is present; `false`
+     * disables it; an object injects the key source / endpoint.
+     */
+    cursorAccountExchange?: boolean | {
+        getApiKey?: () => string | undefined;
+        exchangeUrl?: string;
+    };
 }
 /** Minimal authenticated Origin REST client (the `Octokit` analogue). */
 export interface OriginClient {
@@ -93,8 +147,11 @@ export interface OriginClient {
 }
 /**
  * Build an authenticated Origin REST client. Auth resolution: explicit
- * token/provider, then app credentials (options or environment). Missing
- * auth fails at the first request with a clear message.
+ * token/provider, then app credentials (options or environment, for
+ * channels with their own Origin app), then the Cursor-account session
+ * exchange (hosted v2 deployment SAs — reads and writes both run as the
+ * deployment service-account principal). Missing auth fails at the first
+ * request with a clear message.
  */
 export declare function createOriginClient(options?: OriginClientOptions): OriginClient;
 //# sourceMappingURL=api.d.ts.map

package/dist/channels/origin/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAS3E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,GAAG,SAAS,CAWlC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AA8DD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACrC;;;OAGG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAoEd"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAcH;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,2BAA2B,CAAC;AAE3E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAS3E,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;CACpB;AAaD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,oBAAoB,GAAG,SAAS,CAWlC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAGR;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG7E;AA8DD;;;GAGG;AACH,wBAAgB,+BAA+B,IAAI,MAAM,CAMxD;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,mBAAmB,GAAG;IAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,CAAC;AA4BF,gEAAgE;AAChE,wBAAgB,uCAAuC,IAAI,IAAI,CAG9D;AAED,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE;IACjD,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACrC,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,0BAA0B,CA8E7B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,mBAAmB,CAmBtB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;IAC3C,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB;;;;;OAKG;IACH,qBAAqB,CAAC,EAClB,OAAO,GACP;QACE,SAAS,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;QACrC,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACP;AAED,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,mBAAwB,GAChC,YAAY,CA6Gd"}

package/dist/channels/origin/api.js

@@ -1,18 +1,24 @@
 /**
  * Origin public REST helpers (`https://api.cursor.com/v1/origin/...`).
  *
- * Origin writes such as CI check runs are installation-only: they need an
- * `oit_…` installation token minted from Origin app credentials (EdDSA app
- * JWT → `/v1/origin/app/installations/{id}/access_tokens`). This module
- * consolidates that flow so agents configure credentials once and call
- * {@link createOriginClient} — the GitHub-channel analogue of
+ * This module consolidates Origin auth so agents configure credentials once
+ * and call {@link createOriginClient} — the GitHub-channel analogue of
  * `createGitHubOctokit`.
  *
- * Credentials resolve from options first, then the environment:
- * `ORIGIN_APP_ID` (or `AGENT_SERVE_ORIGIN_APP_ID`),
- * `ORIGIN_APP_INSTALLATION_ID`, `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the
- * app's Ed25519 key; literal `\n` sequences are normalized), and
- * `ORIGIN_API_BASE_URL` for the public REST base.
+ * Self-configured channels with their own Origin app resolve credentials
+ * from options first, then the environment: `ORIGIN_APP_ID` (or
+ * `AGENT_SERVE_ORIGIN_APP_ID`), `ORIGIN_APP_INSTALLATION_ID`,
+ * `ORIGIN_APP_PRIVATE_KEY` (PKCS8 PEM for the app's Ed25519 key; literal
+ * `\n` sequences are normalized), `ORIGIN_API_BASE_URL` for the public REST
+ * base, and `ORIGIN_RPC_BASE_URL` for the first-party ConnectRPC base.
+ *
+ * Hosted v2 forks configure none of that: their only credential is the
+ * deployment service account's `CURSOR_API_KEY`, exchanged for a Cursor
+ * session ({@link cursorSessionTokenProvider}, `POST
+ * /auth/exchange_user_api_key`) and sent as the Origin bearer. Reads and
+ * writes both run as the deployment **service-account principal**; Origin's
+ * `agent-serve` allowlist grants team-namespace read/write, so there is no
+ * app-installation token exchange for managed deployments.
  */
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -25,12 +31,22 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { Buffer } from "node:buffer";
 import { createPrivateKey, sign } from "node:crypto";
+import { cursorBackendUrl, resolveApiKeySync, } from "../../internal/cursor/credentials.js";
+import { CURSOR_SESSION_EXCHANGE_PATH, exchangeCursorApiKeyForSession, SESSION_TOKEN_EXPIRY_LEEWAY_MS, } from "../../internal/cursor/session-token.js";
 /**
  * Public Origin REST base (check runs, installation tokens). Distinct from
  * the webhook JWKS base (`DEFAULT_ORIGIN_API_BASE_URL` in
  * `origin-webhook.ts`).
  */
 export const DEFAULT_ORIGIN_PUBLIC_API_BASE_URL = "https://api.cursor.com";
+/**
+ * Origin's first-party ConnectRPC host (`origin.v1.OriginService`). Separate
+ * deployment from {@link DEFAULT_ORIGIN_PUBLIC_API_BASE_URL}: a handful of
+ * workflow operations — comment reactions among them — have no
+ * `/v1/origin/...` REST binding yet and are only reachable as Connect unary
+ * JSON here.
+ */
+export const DEFAULT_ORIGIN_RPC_BASE_URL = "https://api.origin.cursor.com";
 /** Fixed audience for Origin app JWTs (`APP_TOKEN_AUDIENCE` backend-side). */
 const ORIGIN_APP_TOKEN_AUDIENCE = "origin-apps";
 const APP_JWT_TTL_SECONDS = 5 * 60;
@@ -86,6 +102,12 @@ export function originPublicApiBaseUrl(env = process.env) {
     const fromEnv = (_a = envValue(env.ORIGIN_API_BASE_URL)) === null || _a === void 0 ? void 0 : _a.replace(/\/+$/, "");
     return fromEnv !== null && fromEnv !== void 0 ? fromEnv : DEFAULT_ORIGIN_PUBLIC_API_BASE_URL;
 }
+/** Origin ConnectRPC base. Trailing slashes are stripped for path joins. */
+export function originRpcBaseUrl(env = process.env) {
+    var _a;
+    const fromEnv = (_a = envValue(env.ORIGIN_RPC_BASE_URL)) === null || _a === void 0 ? void 0 : _a.replace(/\/+$/, "");
+    return fromEnv !== null && fromEnv !== void 0 ? fromEnv : DEFAULT_ORIGIN_RPC_BASE_URL;
+}
 function base64UrlJson(value) {
     return Buffer.from(JSON.stringify(value)).toString("base64url");
 }
@@ -132,6 +154,109 @@ function mintOriginInstallationToken(input) {
         return token;
     });
 }
+/**
+ * Exchange endpoint for Cursor-account session tokens. Override with
+ * `AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL`; defaults to the Cursor backend.
+ */
+export function resolveCursorSessionExchangeUrl() {
+    const override = process.env.AGENT_SERVE_CURSOR_SESSION_EXCHANGE_URL;
+    if (override !== undefined && override.trim() !== "") {
+        return override.trim().replace(/\/+$/, "");
+    }
+    return `${cursorBackendUrl()}${CURSOR_SESSION_EXCHANGE_PATH}`;
+}
+/**
+ * Token provider backed by the shared Cursor session exchange
+ * (`exchangeCursorApiKeyForSession`, `POST /auth/exchange_user_api_key` —
+ * the same primitive `CursorBackendClient` mints through).
+ *
+ * Hosted v2 forks hold exactly one credential — the deployment service
+ * account's `CURSOR_API_KEY` — and Origin authenticates the exchanged
+ * session directly: reads and writes run as the deployment
+ * **service-account principal**, confined server-side to namespaces owned
+ * by the deployment's team (`agent-serve` allowlist). Local runs work the
+ * same way with a personal key: Origin authorizes the user principal.
+ *
+ * The API key is re-read on every mint so Bind can drop
+ * `CURSOR_API_KEY_FILE` onto a listening process; sessions are cached until
+ * shortly before their JWT expiry. The cache is **process-wide**, keyed by
+ * (endpoint, API key): hosted channels build a fresh `createOriginClient()`
+ * per event, so a per-provider cache would re-exchange on every read/write
+ * and concurrent first calls would race. In-flight exchanges are deduped
+ * for the same reason.
+ */
+const cursorSessionTokenCache = new Map();
+const cursorSessionTokenInFlight = new Map();
+/** Test-only: drop the process-wide exchanged-session cache. */
+export function _clearCursorSessionTokenCacheForTesting() {
+    cursorSessionTokenCache.clear();
+    cursorSessionTokenInFlight.clear();
+}
+export function cursorSessionTokenProvider(input) {
+    var _a, _b, _c;
+    const getApiKey = (_a = input === null || input === void 0 ? void 0 : input.getApiKey) !== null && _a !== void 0 ? _a : (() => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; });
+    const fetchImpl = (_b = input === null || input === void 0 ? void 0 : input.fetch) !== null && _b !== void 0 ? _b : fetch;
+    const now = (_c = input === null || input === void 0 ? void 0 : input.now) !== null && _c !== void 0 ? _c : Date.now;
+    const cacheKey = (url, apiKey) => `${url}\u0000${apiKey}`;
+    const resolveUrl = () => { var _a; return (_a = input === null || input === void 0 ? void 0 : input.exchangeUrl) !== null && _a !== void 0 ? _a : resolveCursorSessionExchangeUrl(); };
+    const mint = (url, apiKey) => __awaiter(this, void 0, void 0, function* () {
+        const nowMs = now();
+        let session;
+        try {
+            session = yield exchangeCursorApiKeyForSession({
+                exchangeUrl: url,
+                apiKey,
+                fetchImpl,
+                nowMs,
+            });
+        }
+        catch (error) {
+            throw new Error(`originClient: ${error instanceof Error ? error.message : String(error)} Check CURSOR_API_KEY / CURSOR_API_KEY_FILE, or pass an explicit token.`);
+        }
+        const renewAtMs = Math.max(nowMs + 1000, session.expiresAtMs - SESSION_TOKEN_EXPIRY_LEEWAY_MS);
+        cursorSessionTokenCache.set(cacheKey(url, apiKey), {
+            token: session.token,
+            renewAtMs,
+        });
+        return session.token;
+    });
+    const provider = () => __awaiter(this, void 0, void 0, function* () {
+        const apiKey = getApiKey();
+        if (apiKey === undefined || apiKey === "") {
+            throw new Error("originClient: no Cursor credential available for the session exchange (set CURSOR_API_KEY or CURSOR_API_KEY_FILE).");
+        }
+        const url = resolveUrl();
+        const key = cacheKey(url, apiKey);
+        const cached = cursorSessionTokenCache.get(key);
+        if (cached !== undefined && now() < cached.renewAtMs) {
+            return cached.token;
+        }
+        // Dedupe concurrent first calls: one exchange per (endpoint, key).
+        const inFlight = cursorSessionTokenInFlight.get(key);
+        if (inFlight !== undefined) {
+            return yield inFlight;
+        }
+        const pending = mint(url, apiKey).finally(() => {
+            cursorSessionTokenInFlight.delete(key);
+        });
+        cursorSessionTokenInFlight.set(key, pending);
+        return yield pending;
+    });
+    // Origin answered 401 for this bearer: drop it (unless a newer session
+    // already replaced it) so the next call re-exchanges immediately.
+    const invalidate = (token) => {
+        var _a;
+        const apiKey = getApiKey();
+        if (apiKey === undefined || apiKey === "") {
+            return;
+        }
+        const key = cacheKey(resolveUrl(), apiKey);
+        if (((_a = cursorSessionTokenCache.get(key)) === null || _a === void 0 ? void 0 : _a.token) === token) {
+            cursorSessionTokenCache.delete(key);
+        }
+    };
+    return Object.assign(provider, { invalidate });
+}
 /**
  * A cached per-use token provider for one set of app credentials. Every call
  * inside the reuse window returns the same `oit_…`; the first call after it
@@ -160,16 +285,23 @@ export function originAppTokenProvider(input) {
 }
 /**
  * Build an authenticated Origin REST client. Auth resolution: explicit
- * token/provider, then app credentials (options or environment). Missing
- * auth fails at the first request with a clear message.
+ * token/provider, then app credentials (options or environment, for
+ * channels with their own Origin app), then the Cursor-account session
+ * exchange (hosted v2 deployment SAs — reads and writes both run as the
+ * deployment service-account principal). Missing auth fails at the first
+ * request with a clear message.
  */
 export function createOriginClient(options = {}) {
     var _a, _b;
     const apiBaseUrl = ((_a = options.apiBaseUrl) !== null && _a !== void 0 ? _a : originPublicApiBaseUrl()).replace(/\/+$/, "");
     const fetchImpl = (_b = options.fetch) !== null && _b !== void 0 ? _b : fetch;
     let tokenProvider;
+    // Set when the session-exchange fallback is engaged: a 401 from Origin
+    // invalidates the cached session and retries once with a fresh one, the
+    // `CursorBackendClient` re-exchange behavior.
+    let sessionProvider;
     const getToken = () => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b, _c, _d;
         if (typeof options.token === "string") {
             return options.token;
         }
@@ -177,31 +309,56 @@ export function createOriginClient(options = {}) {
             return yield options.token();
         }
         if (tokenProvider === undefined) {
-            const credentials = (_a = options.credentials) !== null && _a !== void 0 ? _a : resolveOriginAppCredentials();
-            if (credentials === undefined) {
-                throw new Error("originClient: no Origin credential available (pass token / credentials, or set ORIGIN_APP_ID + ORIGIN_APP_INSTALLATION_ID + ORIGIN_APP_PRIVATE_KEY).");
+            const credentials = options.credentials === false
+                ? undefined
+                : ((_a = options.credentials) !== null && _a !== void 0 ? _a : resolveOriginAppCredentials());
+            const exchange = (_b = options.cursorAccountExchange) !== null && _b !== void 0 ? _b : true;
+            const exchangeOptions = exchange === false ? undefined : exchange === true ? {} : exchange;
+            const getExchangeApiKey = (_c = exchangeOptions === null || exchangeOptions === void 0 ? void 0 : exchangeOptions.getApiKey) !== null && _c !== void 0 ? _c : (() => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; });
+            if (credentials !== undefined) {
+                tokenProvider = originAppTokenProvider({
+                    credentials,
+                    apiBaseUrl,
+                    fetch: fetchImpl,
+                });
+            }
+            else if (exchangeOptions !== undefined &&
+                ((_d = getExchangeApiKey()) !== null && _d !== void 0 ? _d : "") !== "") {
+                sessionProvider = cursorSessionTokenProvider(Object.assign({ fetch: fetchImpl, getApiKey: getExchangeApiKey }, (exchangeOptions.exchangeUrl === undefined
+                    ? {}
+                    : { exchangeUrl: exchangeOptions.exchangeUrl })));
+                tokenProvider = sessionProvider;
+            }
+            else {
+                throw new Error("originClient: no Origin credential available (pass token / credentials, set ORIGIN_APP_ID + ORIGIN_APP_INSTALLATION_ID + ORIGIN_APP_PRIVATE_KEY, or sign in with a Cursor credential for the session exchange).");
             }
-            tokenProvider = originAppTokenProvider({
-                credentials,
-                apiBaseUrl,
-                fetch: fetchImpl,
-            });
         }
         return yield tokenProvider();
     });
+    const send = (input, path, token) => __awaiter(this, void 0, void 0, function* () {
+        return yield fetchImpl(`${apiBaseUrl}${path}`, {
+            method: input.method,
+            headers: Object.assign({ authorization: `Bearer ${token}` }, (input.body === undefined
+                ? {}
+                : { "content-type": "application/json" })),
+            body: input.body === undefined ? undefined : JSON.stringify(input.body),
+        });
+    });
     return {
         apiBaseUrl,
         request(input) {
             return __awaiter(this, void 0, void 0, function* () {
                 const path = input.path.startsWith("/") ? input.path : `/${input.path}`;
                 const token = yield getToken();
-                const response = yield fetchImpl(`${apiBaseUrl}${path}`, {
-                    method: input.method,
-                    headers: Object.assign({ authorization: `Bearer ${token}` }, (input.body === undefined
-                        ? {}
-                        : { "content-type": "application/json" })),
-                    body: input.body === undefined ? undefined : JSON.stringify(input.body),
-                });
+                let response = yield send(input, path, token);
+                if (response.status === 401 && sessionProvider !== undefined) {
+                    // The session aged out server-side. Drop it — unless a concurrent
+                    // retry already minted a newer one — and retry once.
+                    yield response.text().catch(() => undefined);
+                    sessionProvider.invalidate(token);
+                    const retryToken = yield getToken();
+                    response = yield send(input, path, retryToken);
+                }
                 const text = yield response.text();
                 let parsed;
                 try {

package/dist/channels/origin/binding.d.ts

@@ -10,6 +10,7 @@
  */
 import { type OriginApiMethod } from "./api.js";
 import { type OriginCheck, type OriginCheckCreateInput } from "./checks.js";
+import { type OriginCommentReactionInput } from "./reactions.js";
 import type { OriginAppOptions, OriginRepositoryRef } from "./types.js";
 /** Origin operations exposed to hooks (`ctx.origin`). */
 export interface OriginHandle {
@@ -27,15 +28,25 @@ export interface OriginHandle {
     }): Promise<T>;
     /**
      * Open a CI check run on `sha` and get a handle for updating and
-     * concluding it. Needs an app installation with
-     * `repository:checks:write` — Origin check writes are installation-only.
+     * concluding it. Needs `repository:checks:write` — via an app
+     * installation, or the deployment service account on hosted v2 forks.
      */
     createCheck(input: Omit<OriginCheckCreateInput, "origin" | "owner" | "repo">): Promise<OriginCheck>;
+    /**
+     * Add or remove one reaction on a PR comment — the Origin analogue of
+     * GitHub's `thread.react("eyes")`. Needs
+     * `repository:pull_requests:reviews:write`. Reactions have no REST
+     * binding, so this call goes to Origin's ConnectRPC host rather than the
+     * public API base {@link request} uses.
+     */
+    reactToComment(input: OriginCommentReactionInput): Promise<void>;
 }
 export declare function buildOriginBinding(input: {
     repository: OriginRepositoryRef;
     /** Installation id from the delivery envelope, when present. */
     installationId?: string;
+    /** Force the signed-in Cursor account / deployment SA credential path. */
+    cursorAccount?: boolean;
     /** Channel-authored outbound app credentials / API base. */
     app?: OriginAppOptions;
     /** Injectable fetch for tests. */

package/dist/channels/origin/binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,mBAAmB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACf;;;;OAIG;IACH,WAAW,CACT,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC,GAC/D,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,UAAU,EAAE,mBAAmB,CAAC;IAChC,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,YAAY,CAuCf"}
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../../src/channels/origin/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAEL,KAAK,eAAe,EAIrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExE,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,UAAU,EAAE,mBAAmB,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAC1B,MAAM,EAAE,eAAe,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACf;;;;OAIG;IACH,WAAW,CACT,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC,GAC/D,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,UAAU,EAAE,mBAAmB,CAAC;IAChC,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,YAAY,CAqDf"}