@cursor/july 0.1.99 → 0.1.100

package/src/internal/deploy-client.ts

@@ -1,7 +1,7 @@
 /**
  * Thin client for the Agent Serve deployment management API
  * (`/internal/agent-serve/deployments` on the Cursor backend) and the v2
- * AgentSDK accept path (`/internal/agentkit/deployments`). Pure
+ * AgentSDK accept path (`/internal/agentsdk/deployments`). Pure
  * request/response + error mapping — no console I/O, no polling loops;
  * rendering lives in `cli-deploy.ts`.
  *
@@ -214,7 +214,7 @@ export interface StopAccepted {
 export type DeleteAccepted = StopAccepted;
 
 /**
- * `POST /internal/agentkit/deployments` 202 body. Distinct from v1
+ * `POST /internal/agentsdk/deployments` 202 body. Distinct from v1
  * {@link DeployAccepted}: the v2 control plane returns catalog ids, not
  * an engine alias or one-shot alias token.
  */
@@ -234,7 +234,7 @@ export interface AgentkitDeployComponent {
   agentPath?: string;
 }
 
-/** Customer-visible v2 deploy status (`GET /internal/agentkit/deployments/:slug`). */
+/** Customer-visible v2 deploy status (`GET /internal/agentsdk/deployments/:slug`). */
 export type AgentkitCustomerStatus =
   | "pending"
   | "deploying"
@@ -273,7 +273,7 @@ export const TERMINAL_AGENTKIT_DEPLOY_STATUSES: ReadonlySet<AgentkitCustomerStat
   new Set(["running", "failed", "stopped"]);
 
 /**
- * `POST /internal/agentkit/deployments/:slug/stop` 202 body. Like v1
+ * `POST /internal/agentsdk/deployments/:slug/stop` 202 body. Like v1
  * {@link StopAccepted} but keyed by catalog ids instead of the numeric
  * deployment row id.
  */
@@ -594,7 +594,7 @@ export class AgentServeDeployClient {
 
   /**
    * Create or redeploy onto the v2 control plane
-   * (`POST /internal/agentkit/deployments`). 202 means accepted; poll
+   * (`POST /internal/agentsdk/deployments`). 202 means accepted; poll
    * {@link getAgentkitDeploy} until a terminal status. `components` deploys
    * one application with several release components (one per agent
    * directory); it is mutually exclusive with `agentPath`.
@@ -625,7 +625,7 @@ export class AgentServeDeployClient {
     }
     const raw = await this.request({
       method: "POST",
-      path: "/internal/agentkit/deployments",
+      path: "/internal/agentsdk/deployments",
       body: {
         teamId: args.teamId,
         slug: args.slug,
@@ -650,14 +650,14 @@ export class AgentServeDeployClient {
   }): Promise<AgentkitDeployStatus> {
     const raw = await this.request({
       method: "GET",
-      path: `/internal/agentkit/deployments/${encodeURIComponent(args.slug)}?teamId=${args.teamId}`,
+      path: `/internal/agentsdk/deployments/${encodeURIComponent(args.slug)}?teamId=${args.teamId}`,
       context: { verb: "get deployment", slug: args.slug },
     });
     return agentkitDeployStatusSchema.parse(raw);
   }
 
   /**
-   * Stop a v2 deployment (`POST /internal/agentkit/deployments/:slug/stop`).
+   * Stop a v2 deployment (`POST /internal/agentsdk/deployments/:slug/stop`).
    * 202 means accepted; poll {@link getAgentkitDeploy} until `stopped`.
    */
   async stopAgentkit(args: {
@@ -666,7 +666,7 @@ export class AgentServeDeployClient {
   }): Promise<AgentkitStopAccepted> {
     const raw = await this.request({
       method: "POST",
-      path: `/internal/agentkit/deployments/${encodeURIComponent(args.slug)}/stop?teamId=${args.teamId}`,
+      path: `/internal/agentsdk/deployments/${encodeURIComponent(args.slug)}/stop?teamId=${args.teamId}`,
       context: { verb: "stop", slug: args.slug },
     });
     return agentkitStopAcceptedSchema.parse(raw);
@@ -977,7 +977,7 @@ function mapErrorResponse(
       // (api2 vs api.cursor.com), not a missing deployment / closed gate.
       if (/Route \S+ not found/i.test(bodyText)) {
         return new DeployApiError(
-          `Agent Serve deploy API not found on this host — use the default api.cursor.com (unset CURSOR_API_BASE_URL), or point CURSOR_API_BASE_URL at a backend that mounts /internal/agent-serve/* and /internal/agentkit/*.`,
+          `Agent Serve deploy API not found on this host — use the default api.cursor.com (unset CURSOR_API_BASE_URL), or point CURSOR_API_BASE_URL at a backend that mounts /internal/agent-serve/* and /internal/agentsdk/*.`,
           404
         );
       }

package/src/internal/discovery.ts

@@ -1928,7 +1928,15 @@ async function loadChannels(
       });
       continue;
     }
-    channels.push({ id, definition: mod.default as ChannelDefinition });
+    const definition = mod.default as ChannelDefinition;
+    for (const notice of definition.meta?.deprecations ?? []) {
+      ctx.diagnostics.push({
+        severity: "warning",
+        path: displayPath(ctx, entryPath),
+        message: notice,
+      });
+    }
+    channels.push({ id, definition });
   }
   return { channels, httpChannelDefinition };
 }

package/src/internal/framework-file-storage.ts

@@ -167,11 +167,8 @@ function decodeDocument(key: string, bytes: Uint8Array): JsonValue {
  * Split one storage core by key kind: framework session state to `files`,
  * everything else to `kv`. Spread over the KV backend when building the
  * full definition so its `evals` / `abs` groups (and the cursor-hosted
- * marker) ride along untouched. A KV `cas` group must not be spread as-is:
- * conditional writes run on a KV database row, so one over a `session/` or
- * `continuation/` key would read and write a different store than the
- * routed plain core — silent split-brain. Nothing in the package CASes
- * those kinds today.
+ * marker) ride along untouched; wrap the KV `cas` group with
+ * {@link frameworkGuardedCas} rather than spreading it as-is.
  */
 export function composeFrameworkStorage(input: {
   kv: FileSinkStorageCore;
@@ -192,3 +189,42 @@ export function composeFrameworkStorage(input: {
     listNewest: undefined,
   };
 }
+
+/**
+ * The KV backend's conditional writes, refusing framework-file keys.
+ *
+ * CAS runs on the KV proxy (a database row version); the plain core routes
+ * framework session state to the file store. A future coordination path
+ * that CASes a `session/` or `continuation/` key would otherwise read and
+ * write a different store than the plain path — silent split-brain. Fail
+ * loudly instead; nothing in the package CASes those kinds today.
+ */
+export function frameworkGuardedCas(
+  cas: NonNullable<StorageConfig["cas"]>
+): NonNullable<StorageConfig["cas"]> {
+  const refuse = (key: string): void => {
+    if (isFrameworkFileKey(key)) {
+      throw new Error(
+        `framework file storage: conditional writes are KV-only, but "${key}" routes to the framework file store`
+      );
+    }
+  };
+  return {
+    getWithVersion: (key, ctx) => {
+      refuse(key);
+      return cas.getWithVersion(key, ctx);
+    },
+    putIfAbsent: (key, value, ctx) => {
+      refuse(key);
+      return cas.putIfAbsent(key, value, ctx);
+    },
+    putIfVersion: (key, value, expectedVersion, ctx) => {
+      refuse(key);
+      return cas.putIfVersion(key, value, expectedVersion, ctx);
+    },
+    listKeys: (prefix, ctx) => {
+      refuse(prefix);
+      return cas.listKeys(prefix, ctx);
+    },
+  };
+}

package/src/internal/framework-storage-selection.ts

@@ -18,18 +18,18 @@
  * - **Cursor-managed hosting** (the deployment-generation environment
  *   variable is set, same signal that registers `GET /v1/manifest`):
  *   the deployment's **framework-level file store**
- *   (`AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID`) holds session records, event
- *   transcripts, and the continuation index — file-shaped state on file
- *   storage, apart from the author-facing user store. The control-plane KV
- *   proxy is *not* used: it authorizes by mapping a pod service account to
- *   a v1 deployment row, which no v2 deployment has, so every call 403s and
- *   fails the delivery that read it. The KV half is inert until the proxy
- *   resolves v2 deployments (see null-kv-storage.ts). Without a framework
- *   store (a deploy predating framework-store provisioning) there is
- *   nothing left to mirror to, so the state root is again the only copy.
- *   The API key resolves through the full credential chain on every call
- *   because hosted freeze snapshots listen unsigned and the binder drops
- *   the key file after restore.
+ *   (`AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID`, bound at task time) holds
+ *   session records, event transcripts, and the continuation index —
+ *   file-shaped state on file storage, apart from the author-facing user
+ *   store. Author `host.kv`, eval runs, A/B samples, and conditional writes
+ *   ride the AgentSDK v2 KV proxy (cursor-hosted-v2.ts), which resolves the
+ *   pod service account to the factorydb deployment row (the v1 Bugbot
+ *   proxy cannot resolve v2 pods at all). Framework session state never
+ *   routes to the KV proxy — the composite splits by key kind — so
+ *   transcripts stay off the author-reachable KV namespace. The API key
+ *   resolves through the full credential chain on every call because hosted
+ *   freeze snapshots listen unsigned and the binder drops the key file
+ *   after restore.
  * - **Self-hosted**: no mirror. `--state-root` is the durable copy, which
  *   is correct when the operator owns the disk.
  *
@@ -47,17 +47,15 @@ import {
   cursorHostedFiles,
 } from "../files-backends/cursor-hosted.js";
 import { defineStorage, type StorageDefinition } from "../storage.js";
-import { CURSOR_HOSTED_STORAGE } from "../storage-backends/cursor-hosted.js";
+import { cursorHostedStorageV2 } from "../storage-backends/cursor-hosted-v2.js";
 import type { AgentArchitecture } from "../types.js";
 import { resolveApiKeySync } from "./cursor/credentials.js";
 import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
 import {
   composeFrameworkStorage,
   fileSinkStorageCore,
+  frameworkGuardedCas,
 } from "./framework-file-storage.js";
-import { nullKvStorage } from "./null-kv-storage.js";
-
-const cursorHostedMarker = { [CURSOR_HOSTED_STORAGE]: true } as const;
 
 export interface FrameworkStorageSelectionInput {
   /** `agent/storage.ts`, when the author wrote one (v1 only: discovery rejects it on v2). */
@@ -100,44 +98,33 @@ export function selectFrameworkStorageDefinition(
   // comes up). Follow-ups restore lazily by continuation or session id;
   // GET /v1/sessions lists from the sink either way.
   const policy = { restore: "off" } as const;
-  const frameworkStoreId = cursorFrameworkStoreSourceId(
-    env as NodeJS.ProcessEnv
-  );
-  if (frameworkStoreId === undefined) {
-    // Nothing to mirror to: the KV proxy rejects v2 service accounts, so a
-    // definition over it would fail every delivery that reads it. The state
-    // root is the durable copy, as when self-hosted.
-    return undefined;
-  }
-  // Full chain (env → key file → stored login): frozen engines listen
-  // unsigned and bind CURSOR_API_KEY_FILE at task time, after this
+  const envSnapshot = env as NodeJS.ProcessEnv;
+  // Full chain (env → bind file → stored login): frozen engines listen
+  // unsigned and bind store ids + CURSOR_API_KEY at task time, after this
   // definition is constructed.
   const resolveApiKey = (): string | undefined => resolveApiKeySync()?.apiKey;
-  // Framework session state on the framework-level file store, which
-  // authorizes by store source id and so works for v2. Everything the KV
-  // proxy used to serve — author kv, eval runs, A/B samples, conditional
-  // writes — is inert; `defineStorage` derives the eval/A/B tables over the
-  // core, which means that bookkeeping reads back empty rather than 403ing.
-  //
-  // Restoring `cursorHostedStorage()` here once the proxy resolves v2
-  // deployments also means restoring the guard its `cas` group needs: a
-  // conditional write over a `session/` or `continuation/` key would run on
-  // the KV database while the plain core routes that key to the file store.
-  const kv = nullKvStorage();
+  // v2 pods carry a factorydb-bound service account, which the v1 Bugbot
+  // storage proxy cannot resolve; author KV, CAS coordination, and the
+  // eval/A-B tables speak the AgentSDK v2 KV proxy instead. It also carries
+  // the cursor-hosted marker, so GET /v1/sessions prefers the durable list
+  // (session records are on the framework store, which the composed core
+  // lists).
+  const kv = cursorHostedStorageV2({ resolveApiKey });
   return defineStorage({
     name: "cursor-hosted (framework files)",
     policy,
-    // GET /v1/sessions still prefers the durable list: session records live
-    // on the framework store, which the composed core lists. Spread rather
-    // than named, the way cursorHostedStorage carries it: the marker is a
-    // platform stamp, not part of the authored config surface.
-    ...cursorHostedMarker,
     ...kv,
     ...composeFrameworkStorage({
       kv,
       files: fileSinkStorageCore(
-        cursorHostedFiles({ storeSourceId: frameworkStoreId, resolveApiKey })
+        cursorHostedFiles({
+          resolveStoreSourceId: () => cursorFrameworkStoreSourceId(envSnapshot),
+          resolveApiKey,
+        })
       ),
     }),
+    // CAS stays on the KV proxy but must refuse framework-file keys, or a
+    // future coordination path would split-brain against the plain core.
+    cas: frameworkGuardedCas(kv.cas),
   });
 }

package/src/internal/session-run-log.ts

@@ -547,9 +547,9 @@ export function createSessionRunLogStore(input: {
 
 /**
  * Same selection as the conversation mirror: architecture-v2 hosted
- * engines with a provisioned framework file store. Self-hosted and v1
- * stay on local disk / today's behavior. This is the only path that
- * installs the session-run log — v1 never writes these documents.
+ * engines (generation env set). Store ids resolve lazily from env or the
+ * task-bind files under `/run/cursor/secrets`. Self-hosted and v1 stay on
+ * local disk / today's behavior.
  */
 export function selectSessionRunLogStore(input: {
   project: AgentProject;
@@ -561,18 +561,13 @@ export function selectSessionRunLogStore(input: {
     return undefined;
   }
   const env = input.env ?? process.env;
-  const frameworkStoreId = cursorFrameworkStoreSourceId(
-    env as NodeJS.ProcessEnv
-  );
-  if (
-    env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined ||
-    frameworkStoreId === undefined
-  ) {
+  if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined) {
     return undefined;
   }
+  const envSnapshot = env as NodeJS.ProcessEnv;
   return createSessionRunLogStore({
     sink: cursorHostedFiles({
-      storeSourceId: frameworkStoreId,
+      resolveStoreSourceId: () => cursorFrameworkStoreSourceId(envSnapshot),
       resolveApiKey: () => resolveApiKeySync()?.apiKey,
     }),
     agentName: input.project.name,

package/src/internal/storage-coordinator.ts

@@ -38,7 +38,6 @@ import type { JsonValue, SessionEvent, SessionRecord } from "../types.js";
 import type { ABSnapshot } from "./ab-snapshot.js";
 import { describeError } from "./describe-error.js";
 import type { EvalRunStorage } from "./eval-run-store.js";
-import { isAuthorKvUnsupported } from "./null-kv-storage.js";
 import type {
   AuthorKvStore,
   EvalAbStore,
@@ -469,18 +468,9 @@ export class StorageCoordinator
   /**
    * Whether the sink can serve awaited author reads/writes (`get` is
    * required — `put` is always present on {@link StorageConfig}).
-   *
-   * A sink may keep `get` for framework session state while refusing author
-   * KV: hosted v2 reads sessions from the framework file store but has no
-   * working KV backend, and author handlers that cannot read their own
-   * writes back are better served by the local-disk fallback than by a sink
-   * that accepts every write and forgets it.
    */
   get supportsAuthorKv(): boolean {
-    return (
-      this.definition.get !== undefined &&
-      !isAuthorKvUnsupported(this.definition)
-    );
+    return this.definition.get !== undefined;
   }
 
   /**

package/src/storage-backends/cursor-hosted-v2.ts

@@ -0,0 +1,219 @@
+/**
+ * Cursor-managed durable KV for hosted **architecture v2** agents.
+ *
+ * Talks to the AgentSDK v2 KV proxy
+ * (`POST /internal/agentsdk/kv/*`) using the engine's pod
+ * `CURSOR_API_KEY`. The server resolves the v2 deployment from that service
+ * account (factorydb `agentsdk_deployment`) and persists rows in factorydb
+ * `agentsdk_kv` — v1's Bugbot-backed `/internal/agent-serve/storage/*`
+ * routes cannot resolve a v2 pod credential at all.
+ *
+ * The v2 wire protocol is four routes, not v1's eight:
+ *
+ * - `POST /internal/agentsdk/kv/get`
+ *   `{ key }` → `{ found, value, version }` — reads always carry the CAS
+ *   version token ({@link KvV2GetResponse}).
+ * - `POST /internal/agentsdk/kv/put`
+ *   `{ key, value, ifAbsent? | ifVersion? }` → `{ ok, version, current }`
+ *   ({@link KvV2PutResponse}) — one write primitive: last-write-wins when
+ *   unconditional (still bumps the token), atomic create-if-absent with
+ *   `ifAbsent: true`, atomic compare-and-swap with `ifVersion`.
+ * - `POST /internal/agentsdk/kv/delete` `{ key }` → `{ ok }`.
+ * - `POST /internal/agentsdk/kv/list`
+ *   `{ prefix, limit?, cursor?, keysOnly? }` → `{ entries, nextCursor }`
+ *   ({@link KvV2ListResponse}) — ascending key order with keyset
+ *   pagination. `list` / `listKeys` below drain every page, so the v1
+ *   truncated-scan failure mode does not exist here.
+ *
+ * Eval runs and A/B samples still ride the v1 storage proxy's dedicated
+ * tables (`evals` / `abs` below); moving them to factorydb is a separate
+ * follow-up from the KV cutover.
+ *
+ * This backend is platform-selected for architecture v2
+ * (framework-storage-selection.ts) — authors never import it; `agent/storage.ts`
+ * is rejected on v2.
+ */
+
+import type {
+  StorageABTable,
+  StorageCasTable,
+  StorageConfig,
+  StorageEntry,
+  StorageEvalsTable,
+} from "../storage.js";
+import type { JsonValue, KvCasResult, KvVersionedEntry } from "../types.js";
+import {
+  CURSOR_HOSTED_STORAGE,
+  type CursorHostedStorageOptions,
+  cursorHostedStorage,
+  storageRpc,
+} from "./cursor-hosted.js";
+
+const KV_V2_PREFIX = "/internal/agentsdk/kv";
+
+/** Wire shape of the v2 `get` route. `null` ⇒ JSON `undefined`. */
+export interface KvV2GetResponse {
+  found: boolean;
+  value: JsonValue | null;
+  version: string | null;
+}
+
+/** Wire shape of the v2 `put` route (all three write modes). */
+export interface KvV2PutResponse {
+  ok: boolean;
+  /** New version token on an accepted write, else `null`. */
+  version: string | null;
+  /** Entry observed when a conditional write lost; `null` when absent. */
+  current: { value: JsonValue | null; version: string } | null;
+}
+
+/** Wire shape of the v2 `list` route. */
+export interface KvV2ListResponse {
+  entries: Array<{
+    key: string;
+    /** Omitted when the request asked for keys only. */
+    value?: JsonValue | null;
+    version: string;
+  }>;
+  /** Last key of this page when more rows remain, else `null`. */
+  nextCursor: string | null;
+}
+
+type CursorHostedStorageV2Methods = Required<
+  Pick<StorageConfig, "put" | "get" | "delete" | "list">
+> & {
+  readonly [CURSOR_HOSTED_STORAGE]: true;
+  cas: StorageCasTable;
+  evals: StorageEvalsTable;
+  abs: StorageABTable;
+};
+
+function toCasResult(response: KvV2PutResponse): KvCasResult {
+  if (response.ok) {
+    if (response.version === null) {
+      throw new Error(
+        "cursorHostedStorageV2: conditional write succeeded without a version token"
+      );
+    }
+    return { ok: true, version: response.version };
+  }
+  const current: KvVersionedEntry | undefined =
+    response.current === null
+      ? undefined
+      : {
+          value: response.current.value ?? null,
+          version: response.current.version,
+        };
+  return { ok: false, current };
+}
+
+/**
+ * Drain every page of a v2 `list` scan. The server pages by keyset (each
+ * `nextCursor` is the strictly-greatest key returned so far), so a cursor
+ * that fails to advance means a broken server — fail loudly rather than
+ * loop forever.
+ */
+async function listAllPages(
+  options: CursorHostedStorageOptions,
+  body: { prefix: string; keysOnly?: boolean }
+): Promise<KvV2ListResponse["entries"]> {
+  const entries: KvV2ListResponse["entries"] = [];
+  let cursor: string | undefined;
+  for (;;) {
+    const page = await storageRpc<KvV2ListResponse>(
+      options,
+      `${KV_V2_PREFIX}/list`,
+      cursor === undefined ? body : { ...body, cursor }
+    );
+    entries.push(...page.entries);
+    if (page.nextCursor === null) {
+      return entries;
+    }
+    if (cursor !== undefined && page.nextCursor <= cursor) {
+      throw new Error(
+        `cursorHostedStorageV2: list("${body.prefix}") cursor did not advance`
+      );
+    }
+    cursor = page.nextCursor;
+  }
+}
+
+/**
+ * Architecture-v2 `defineStorage` methods (AgentSDK v2 KV proxy → factorydb
+ * `agentsdk_kv`). Platform-selected; spread into `defineStorage({...})` by
+ * framework-storage-selection.ts. No `listNewest`: v2 session records live
+ * on the framework file store, so the only consumer of write-time ordering
+ * never reaches this backend and the engine's `list` fallback covers the
+ * rest.
+ */
+export function cursorHostedStorageV2(
+  options: CursorHostedStorageOptions = {}
+): CursorHostedStorageV2Methods {
+  // Eval runs and A/B samples stay on the v1 proxy's dedicated tables.
+  const v1 = cursorHostedStorage(options);
+  return {
+    [CURSOR_HOSTED_STORAGE]: true,
+    async put(key, value): Promise<void> {
+      await storageRpc(options, `${KV_V2_PREFIX}/put`, { key, value });
+    },
+    async get(key): Promise<JsonValue | undefined> {
+      const result = await storageRpc<KvV2GetResponse>(
+        options,
+        `${KV_V2_PREFIX}/get`,
+        { key }
+      );
+      if (!result.found) {
+        return undefined;
+      }
+      return result.value ?? undefined;
+    },
+    async delete(key): Promise<void> {
+      await storageRpc(options, `${KV_V2_PREFIX}/delete`, { key });
+    },
+    async list(prefix): Promise<StorageEntry[]> {
+      const entries = await listAllPages(options, { prefix });
+      return entries.map((entry) => ({
+        key: entry.key,
+        value: entry.value ?? null,
+      }));
+    },
+    cas: {
+      async getWithVersion(key): Promise<KvVersionedEntry | undefined> {
+        const result = await storageRpc<KvV2GetResponse>(
+          options,
+          `${KV_V2_PREFIX}/get`,
+          { key }
+        );
+        if (!result.found || result.version === null) {
+          return undefined;
+        }
+        return { value: result.value ?? null, version: result.version };
+      },
+      async putIfAbsent(key, value): Promise<KvCasResult> {
+        const result = await storageRpc<KvV2PutResponse>(
+          options,
+          `${KV_V2_PREFIX}/put`,
+          { key, value, ifAbsent: true }
+        );
+        return toCasResult(result);
+      },
+      async putIfVersion(key, value, expectedVersion): Promise<KvCasResult> {
+        const result = await storageRpc<KvV2PutResponse>(
+          options,
+          `${KV_V2_PREFIX}/put`,
+          { key, value, ifVersion: expectedVersion }
+        );
+        return toCasResult(result);
+      },
+      async listKeys(prefix): Promise<string[]> {
+        const entries = await listAllPages(options, {
+          prefix,
+          keysOnly: true,
+        });
+        return entries.map((entry) => entry.key);
+      },
+    },
+    evals: v1.evals,
+    abs: v1.abs,
+  };
+}

package/src/storage-backends/cursor-hosted.ts

@@ -207,7 +207,12 @@ function resolveBaseUrl(options: CursorHostedStorageOptions): string {
   return raw.endsWith("/") ? raw.slice(0, -1) : raw;
 }
 
-async function storageRpc<T>(
+/**
+ * One authenticated POST to the control-plane proxy. Shared with the
+ * architecture-v2 backend (`cursor-hosted-v2.ts`), which speaks a different
+ * route family over the same transport and credential chain.
+ */
+export async function storageRpc<T>(
   options: CursorHostedStorageOptions,
   path: string,
   body: Record<string, unknown>

package/src/types.ts

@@ -2314,6 +2314,11 @@ export interface ChannelMeta {
    * by `info` so watched channels are auditable.
    */
   slackChannelPosts?: readonly string[];
+  /**
+   * Author-facing notices about deprecated options the pack still honored.
+   * Discovery surfaces each one as a `validate` warning on the channel file.
+   */
+  deprecations?: readonly string[];
 }
 
 export interface ChannelConfig<TState = JsonValue> {