@cursor/july 0.1.99 → 0.1.101

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,GAAG,EACH,WAAW,EACX,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,GAAG,EACH,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,aAAa,EACb,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,qBAAqB,CAEtE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,YAAY,EAAE,MAAM,GAAG,YAAY,EACnC,OAAO,GAAE,YAAY,GAAG;IACtB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAqB3B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,EACb,GAAG,EACH,WAAW,EACX,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,IAAI,EACJ,GAAG,EACH,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,QAAQ,EACR,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,wBAAwB,EACxB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,mBAAmB,YAAY,CAAC;AAChC,OAAO,EACL,oCAAoC,EACpC,aAAa,EACb,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,YAAY,EACZ,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,EAC7B,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,qBAAqB,CAEtE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,GACzB,sBAAsB,CAExB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,KAAK,CACzB,YAAY,EAAE,MAAM,GAAG,YAAY,EACnC,OAAO,GAAE,YAAY,GAAG;IACtB,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAqB3B"}

package/dist/index.js

@@ -43,6 +43,7 @@ export { defineArtifacts } from "./artifacts.js";
 export { allowAll, bearerAuth, DELETE, defineChannel, GET, httpChannel, localDev, localDevStrict, loopbackGitHubDev, loopbackOnly, PATCH, POST, PUT, publicEndpoint, } from "./channels.js";
 export { defineConnection } from "./connections.js";
 export { BUILTINS, bindMailboxContinuationSend, CONTINUATION_SELECTORS, continuationSource, defaultContinuationSelector, extractContinuation, formatConversationKey, handshakeContinuation, isContinuationSelector, mintClaim, normalizeIdentity, parseContinuationSelector, resolveContinuation, resolveV2Key, stampMailboxContinuation, V2EngineError, } from "./continuation.js";
+export { defineExtension, disableTool } from "./extensions.js";
 export { defineHook } from "./hooks.js";
 export { InvalidAsOfError, VacuousTimeArgsError, } from "./internal/as-of.js";
 export { formatDiagnostics, hasErrorDiagnostics, isAgentProjectDir, loadAgentProject, loadAgentProjects, projectInfo, resolveAgentMounts, } from "./internal/discovery.js";
@@ -58,7 +59,7 @@ export { defineSchedule } from "./schedules.js";
 export { defineSkill } from "./skills.js";
 export { defineStorage, isDurableSessionRecordKey, parseDurableSessionRecord, STORAGE_KEY_ROOT, storageKeys, summarizeDurableSessionRecord, } from "./storage.js";
 export { defineTool } from "./tools.js";
-export { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, DIRECT_TOOL_CALL_CHANNEL_ID, isCursorAccountTransport, isPeerConnectionTransport, isSymbolicConnectionTransport, isToolEffect, MAX_RUNNING_TURNS_LIMIT, normalizeConnectionEffects, normalizeCursorAccountServers, supportsKvCas, } from "./types.js";
+export { cursorAccountServersHasMixedWildcard, DEFAULT_MODEL, DIRECT_TOOL_CALL_CHANNEL_ID, isCursorAccountTransport, isPeerConnectionTransport, isSymbolicConnectionTransport, isToolEffect, MAX_RUNNING_TURNS_LIMIT, normalizeConnectionEffects, normalizeConnectionTools, normalizeCursorAccountServers, supportsKvCas, } from "./types.js";
 /**
  * Runtime config for an agent — authored at `agent/agent.ts` (the root
  * agent) or `agent/subagents/<id>/agent.ts` (a subagent). Set

package/dist/internal/advertise-tools.d.ts

@@ -27,10 +27,13 @@
  * `defineConnection({ effects })` filters the listing before names are
  * assigned: only tools whose MCP annotations classify as an intended
  * effect are advertised. Unclassified tools are omitted, not guessed.
+ * `defineConnection({ tools: [...] })` keeps only the named tools.
+ * `disallowedTools` drops names. A name filter that matches nothing on
+ * the server fails the turn.
  * Tools whose `annotations.title` is `do-not-call` are dropped as well
  * (vendor host-UI / MCP Apps helpers that still carry `readOnlyHint`).
  */
-import type { DiscoveredConnection, DiscoveredTool, HostMcpCallResult, HostMcpToolInfo, ResolvedAgent, SessionInfo } from "../types.js";
+import { type DiscoveredConnection, type DiscoveredTool, type HostMcpCallResult, type HostMcpToolInfo, type ResolvedAgent, type SessionInfo } from "../types.js";
 import type { HostMcpOneOff } from "./mcp-host.js";
 /**
  * What the resolver needs from the host MCP registry: the shared cached

package/dist/internal/advertise-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advertise-tools.d.ts","sourceRoot":"","sources":["../../src/internal/advertise-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAGf,aAAa,EACb,WAAW,EAGZ,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,QAAQ,CACN,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAAC;CACzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAC;AAO7E,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA2D5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAsHD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAkBR"}
+{"version":3,"file":"advertise-tools.d.ts","sourceRoot":"","sources":["../../src/internal/advertise-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EAGpB,KAAK,aAAa,EAClB,KAAK,WAAW,EAGjB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,QAAQ,CACN,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CAAC;CACzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAC;AAO7E,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACjE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,CACV,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAgF5B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,oBAAoB,EAChC,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAwB/B;AAsHD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAkBR"}

package/dist/internal/advertise-tools.js

@@ -27,6 +27,9 @@
  * `defineConnection({ effects })` filters the listing before names are
  * assigned: only tools whose MCP annotations classify as an intended
  * effect are advertised. Unclassified tools are omitted, not guessed.
+ * `defineConnection({ tools: [...] })` keeps only the named tools.
+ * `disallowedTools` drops names. A name filter that matches nothing on
+ * the server fails the turn.
  * Tools whose `annotations.title` is `do-not-call` are dropped as well
  * (vendor host-UI / MCP Apps helpers that still carry `readOnlyHint`).
  */
@@ -39,6 +42,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+import { connectionAllowsTool, } from "../types.js";
 import { brandDefinition } from "./brand.js";
 import { sanitizeMcpToolName, suffixMcpToolName, } from "./sanitize-mcp-tool-name.js";
 import { classifyAnnotationsEffect } from "./tool-policy.js";
@@ -70,7 +74,12 @@ export function resolveAdvertisedTools(args) {
             try {
                 const source = yield sourceFor(connection, args.session, args.hostMcp);
                 const listed = yield source.listTools();
-                return { connection, ok: true, source, listed };
+                return {
+                    connection,
+                    ok: true,
+                    source,
+                    listed: listed.filter((info) => connectionAllowsTool(connection, info.name)),
+                };
             }
             catch (error) {
                 return { connection, ok: false, error };
@@ -88,6 +97,16 @@ export function resolveAdvertisedTools(args) {
                 throw new Error(`Failed to list tools on advertised connection "${connection.name}": ${describeError(listing.error)}`, { cause: listing.error });
             }
             const { source, listed } = listing;
+            if ((connection.tools !== undefined ||
+                connection.disallowedTools !== undefined) &&
+                listed.length === 0) {
+                const error = new Error(`Advertised connection "${connection.name}" tool filter matched no tools on the server.`);
+                if (args.onConnectionError !== undefined) {
+                    args.onConnectionError(connection.name, error);
+                    continue;
+                }
+                throw error;
+            }
             const intended = listed.filter((info) => !isDoNotCallTool(info.annotations) &&
                 matchesIntendedEffects(info.annotations, connection.effects));
             const exposed = exposeListedTools(intended, claimed);

package/dist/internal/as-of.d.ts

@@ -16,4 +16,22 @@ export declare function assertTimeArgs(tools: readonly {
     };
 }[], asOf: string | undefined): void;
 export declare function timeArgViolation(input: unknown, timeArgs: readonly string[], asOf: string): string | undefined;
+/** Relative expressions or instants after `asOf`. Numeric epochs need `timeArgs`. */
+export declare function forwardTimeArgument(input: unknown, asOf: string): string | undefined;
+/**
+ * The string-typed time-window properties a tool's input schema declares.
+ * String-typed only: a numeric `from` is a pagination offset more often than
+ * an instant, and requiring an ISO value there would break the call.
+ */
+export declare function schemaTimeWindowKeys(inputSchema: {
+    properties?: Record<string, unknown>;
+} | undefined): string[];
+/**
+ * An omitted time window on a vendor tool is not "no window" — the vendor
+ * fills it with a live default (Datadog: `now-1h`..`now`), which the walker
+ * cannot see because the value is never present. In a frozen session a call
+ * that omits a schema-declared window key is refused so the model supplies
+ * the bound explicitly, where {@link forwardTimeArgument} then checks it.
+ */
+export declare function missingTimeWindow(input: unknown, windowKeys: readonly string[], asOf: string): string | undefined;
 //# sourceMappingURL=as-of.d.ts.map

package/dist/internal/as-of.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"as-of.d.ts","sourceRoot":"","sources":["../../src/internal/as-of.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,IAAI,CAMjE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAQvD;CACF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACxD,EAAE,EACH,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAeN;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CA0BpB"}
+{"version":3,"file":"as-of.d.ts","sourceRoot":"","sources":["../../src/internal/as-of.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,IAAI,CAMjE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAQvD;CACF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACxD,EAAE,EACH,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAeN;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CA0BpB;AA6CD,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAmCpB;AAqBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAChE,MAAM,EAAE,CAoBV;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAkBpB"}

package/dist/internal/as-of.js

@@ -80,3 +80,134 @@ export function timeArgViolation(input, timeArgs, asOf) {
     }
     return undefined;
 }
+// Whole-string only: a query that merely contains "now" is not a bound.
+// Duration-only strings (`30m`, `2h`) and last/this plus a non-window word
+// (`last modified`) are not time bounds. Calendar-aligned `now/d` is.
+const TIME_UNIT = "(?:s|sec|secs|second|seconds|m|min|mins|minute|minutes|h|hr|hrs|hour|hours|d|day|days|w|week|weeks|mo|month|months|y|yr|yrs|year|years)";
+const WINDOW_WORD = "(?:second|seconds|minute|minutes|hour|hours|day|days|week|weeks|month|months|year|years|quarter|quarters|weekend|monday|tuesday|wednesday|thursday|friday|saturday|sunday|morning|afternoon|evening|night)";
+const RELATIVE_TIME_EXPRESSION = new RegExp(`^(?:now(?:\\s*[+-]\\s*\\d+\\s*${TIME_UNIT}\\b.*|/[a-zA-Z]+.*)?|[+-]\\d+\\s*${TIME_UNIT}|today|yesterday|tomorrow|(?:last|this)\\s+${WINDOW_WORD})$`, "i");
+function forwardTimeReason(value, asOf, frozenMs) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (trimmed === "") {
+        return undefined;
+    }
+    if (RELATIVE_TIME_EXPRESSION.test(trimmed)) {
+        return (`Argument ${JSON.stringify(value)} is a relative time expression, ` +
+            `which reads against the real present. This session reads the world ` +
+            `as of ${asOf}; supply an absolute ISO-8601 instant with a timezone ` +
+            `at or before that instant and retry.`);
+    }
+    const instant = parseInstant(trimmed);
+    if (instant !== undefined && instant.getTime() > frozenMs) {
+        return (`Argument ${JSON.stringify(value)} is later than the instant this ` +
+            `session reads the world as of (${asOf}). Supply a bound at or before ` +
+            `that instant and retry.`);
+    }
+    return undefined;
+}
+/** Relative expressions or instants after `asOf`. Numeric epochs need `timeArgs`. */
+export function forwardTimeArgument(input, asOf) {
+    const frozenMs = new Date(asOf).getTime();
+    const seen = new Set();
+    const walk = (value, depth) => {
+        if (depth > 8) {
+            return undefined;
+        }
+        const reason = forwardTimeReason(value, asOf, frozenMs);
+        if (reason !== undefined) {
+            return reason;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                const found = walk(item, depth + 1);
+                if (found !== undefined) {
+                    return found;
+                }
+            }
+            return undefined;
+        }
+        if (typeof value === "object" && value !== null) {
+            if (seen.has(value)) {
+                return undefined;
+            }
+            seen.add(value);
+            for (const item of Object.values(value)) {
+                const found = walk(item, depth + 1);
+                if (found !== undefined) {
+                    return found;
+                }
+            }
+        }
+        return undefined;
+    };
+    return walk(input, 0);
+}
+/**
+ * Property names that carry a query's time window when a vendor schema
+ * declares them. Deliberately narrower than the embedded-filter key list:
+ * these must be safe to *require*, so only unambiguous window names — never
+ * `timestamp`/`date`, which name data fields more often than bounds.
+ */
+const TIME_WINDOW_KEYS = new Set([
+    "from",
+    "to",
+    "since",
+    "until",
+    "start",
+    "end",
+    "start_time",
+    "end_time",
+    "starttime",
+    "endtime",
+]);
+/**
+ * The string-typed time-window properties a tool's input schema declares.
+ * String-typed only: a numeric `from` is a pagination offset more often than
+ * an instant, and requiring an ISO value there would break the call.
+ */
+export function schemaTimeWindowKeys(inputSchema) {
+    const properties = inputSchema === null || inputSchema === void 0 ? void 0 : inputSchema.properties;
+    if (properties === undefined) {
+        return [];
+    }
+    const keys = [];
+    for (const [name, spec] of Object.entries(properties)) {
+        if (!TIME_WINDOW_KEYS.has(name.toLowerCase())) {
+            continue;
+        }
+        const type = typeof spec === "object" && spec !== null
+            ? spec.type
+            : undefined;
+        const types = Array.isArray(type) ? type : [type];
+        if (types.includes("string")) {
+            keys.push(name);
+        }
+    }
+    return keys;
+}
+/**
+ * An omitted time window on a vendor tool is not "no window" — the vendor
+ * fills it with a live default (Datadog: `now-1h`..`now`), which the walker
+ * cannot see because the value is never present. In a frozen session a call
+ * that omits a schema-declared window key is refused so the model supplies
+ * the bound explicitly, where {@link forwardTimeArgument} then checks it.
+ */
+export function missingTimeWindow(input, windowKeys, asOf) {
+    if (windowKeys.length === 0) {
+        return undefined;
+    }
+    const record = typeof input === "object" && input !== null
+        ? input
+        : {};
+    const missing = windowKeys.filter((key) => record[key] === undefined);
+    if (missing.length === 0) {
+        return undefined;
+    }
+    return (`This tool fills omitted time bounds (${missing.join(", ")}) with a ` +
+        `live default window, which reads the real present. This session reads ` +
+        `the world as of ${asOf}; supply each bound explicitly as an absolute ` +
+        `ISO-8601 instant with a timezone at or before that instant and retry.`);
+}

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAexB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmnBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AAwCD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAexB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8F1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmoBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AA2CD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAqBD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAsCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqCjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -161,6 +161,10 @@ export function cmdDeploy(options) {
         if (manifests.every((manifest) => manifest.architecture === "v2")) {
             return deployAgentsdkApplication(ctx, options, targets, {
                 hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+                declaredSecretNames: [
+                    ...new Set(manifests.flatMap((manifest) => { var _a; var _b; return (_b = (_a = manifest.hosting) === null || _a === void 0 ? void 0 : _a.secretNames) !== null && _b !== void 0 ? _b : []; })),
+                ],
+                hasDeploymentsChannels: manifests.some((manifest) => manifest.hasDeploymentsChannels),
             });
         }
         if (!ctx.json &&
@@ -498,6 +502,8 @@ function deployOne(ctx, options, target, extras) {
                 agentPath,
                 repositories: options.cursorEventsRepos,
                 hasScmChannels: manifest.hasScmChannels,
+                declaredSecretNames: hosting === null || hosting === void 0 ? void 0 : hosting.secretNames,
+                hasDeploymentsChannels: manifest.hasDeploymentsChannels,
                 multiTenant: options.multiTenant === true,
             });
         }
@@ -639,13 +645,7 @@ function deployAgentsdkApplication(ctx, options, targets, declarations) {
                     .map((component) => { var _a; return `  component: ${component.componentKey} (${(_a = component.agentPath) !== null && _a !== void 0 ? _a : "."})\n`; })
                     .join(""));
         }
-        // Components bake sequentially on the control plane, so the default wait
-        // budget is per component; otherwise a 2+ component deploy routinely hits
-        // the client-side timeout while the server-side deploy is still fine. An
-        // explicitly passed timeout always wins.
-        const waitCtx = options.timeoutMs === undefined
-            ? Object.assign(Object.assign({}, ctx), { timeoutMs: ctx.timeoutMs * targets.length }) : ctx;
-        return deployOneAgentsdk(waitCtx, undefined, {
+        return deployOneAgentsdk(ctx, undefined, {
             slug,
             gitRepoUrl,
             gitRef,
@@ -653,12 +653,14 @@ function deployAgentsdkApplication(ctx, options, targets, declarations) {
             components,
             repositories: options.cursorEventsRepos,
             hasScmChannels: declarations.hasScmChannels,
+            declaredSecretNames: declarations.declaredSecretNames,
+            hasDeploymentsChannels: declarations.hasDeploymentsChannels,
             multiTenant: options.multiTenant === true,
         });
     });
 }
 /**
- * `architecture: "v2"` deploy: POST `/internal/agentkit/deployments` and
+ * `architecture: "v2"` deploy: POST `/internal/agentsdk/deployments` and
  * poll the matching GET. The v2 accept path starts freeze bake; it does
  * not mint an engine alias or alias token.
  */
@@ -718,6 +720,8 @@ function deployOneAgentsdk(ctx, extras, args) {
             ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
+        warnMissingSecrets(ctx, slug, args.declaredSecretNames, detail.secretNames);
+        const watchesRepositories = args.hasScmChannels || args.hasDeploymentsChannels === true;
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
             `  status:       running\n` +
             `  architecture: v2\n` +
@@ -728,13 +732,14 @@ function deployOneAgentsdk(ctx, extras, args) {
                 : `  components:   ${args.components
                     .map((component) => component.componentKey)
                     .join(", ")}\n`) +
-            (detail.repositories === undefined || !args.hasScmChannels
+            (detail.repositories === undefined || !watchesRepositories
                 ? ""
                 : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`));
-        // An agent with GitHub/Origin channels bound to no repository scope gets
-        // no deliveries at all, which is otherwise invisible in this output.
-        if (args.hasScmChannels && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
-            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin channels receive no events.\n` +
+        // An agent with GitHub/Origin/deployments channels bound to no repository
+        // scope gets no deliveries at all (deployments channels receive the
+        // watched repos' deployment events), which is otherwise invisible here.
+        if (watchesRepositories && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin/deployments channels receive no events.\n` +
                 `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
         }
         return 0;
@@ -833,6 +838,7 @@ function readDeployManifest(dir) {
                 const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
                 return kind === "github" || kind === "origin";
             }),
+            hasDeploymentsChannels: project.channels.some((channel) => { var _a; return ((_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind) === "deployments"; }),
         };
     });
 }
@@ -1013,6 +1019,9 @@ function renderAgentkitDeploymentStatus(ctx, detail) {
             ? "(nothing)"
             : detail.repositories.join(", ")}`);
     }
+    if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+        lines.push(`  secrets:      ${detail.secretNames.join(", ")}`);
+    }
     if (detail.lastError !== null && detail.lastError !== undefined) {
         lines.push(`  last error:   ${sanitizeCustomerError(detail.lastError)}`);
     }
@@ -1036,7 +1045,7 @@ export function cmdStop(slug, options) {
         // deploy). The v2 agentsdk control plane goes first: v1 endpoints refuse
         // `architecture: "v2"` slugs with a 409 rather than a 404, so v1-first
         // could not fall through. A v2 404 (including an older backend without
-        // the `/internal/agentkit` mount) falls back to the v1 stop.
+        // the `/internal/agentsdk` mount) falls back to the v1 stop.
         let architecture = "v2";
         let accepted;
         try {
@@ -1198,6 +1207,20 @@ export function cmdRotatePodCredential(slug, options) {
 // ============================================================================
 // secrets set|list|unset
 // ============================================================================
+function secretDeploymentArchitecture(ctx, slug) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield ctx.client.getAgentkitDeploy({ teamId: ctx.teamId, slug });
+            return "v2";
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                return "v1";
+            }
+            throw error;
+        }
+    });
+}
 export function cmdSecretsSet(slug, specs, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -1248,11 +1271,19 @@ export function cmdSecretsSet(slug, specs, options) {
         }
         let secretNames;
         try {
-            secretNames = yield ctx.client.setSecrets({
-                teamId: ctx.teamId,
-                slug,
-                secrets,
-            });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secretNames =
+                architecture === "v2"
+                    ? yield ctx.client.setAgentkitSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    })
+                    : yield ctx.client.setSecrets({
+                        teamId: ctx.teamId,
+                        slug,
+                        secrets,
+                    });
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1280,7 +1311,11 @@ export function cmdSecretsList(slug, options) {
         }
         let secrets;
         try {
-            secrets = yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            secrets =
+                architecture === "v2"
+                    ? yield ctx.client.listAgentkitSecrets({ teamId: ctx.teamId, slug })
+                    : yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
         }
         catch (error) {
             return renderApiError(error, ctx.err);
@@ -1309,7 +1344,17 @@ export function cmdSecretsUnset(slug, name, options) {
             return ctx;
         }
         try {
-            yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+            const architecture = yield secretDeploymentArchitecture(ctx, slug);
+            if (architecture === "v2") {
+                yield ctx.client.deleteAgentkitSecret({
+                    teamId: ctx.teamId,
+                    slug,
+                    name,
+                });
+            }
+            else {
+                yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+            }
         }
         catch (error) {
             if (error instanceof DeployApiError && error.status === 404) {

package/dist/internal/continuation-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"continuation-identity.d.ts","sourceRoot":"","sources":["../../src/internal/continuation-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,OAAO,GACP,QAAQ,GACR,WAAW,GACX,YAAY,CAAC;AAEjB,eAAO,MAAM,sBAAsB,YACjC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,EACT,SAAS,CACD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACxD,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACpC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;IACpD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,SAAS,mBAAmB,EA+CzC,CAAC;AAEX,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA2BD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,oBAAoB,CAE/B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,2BAAkC,EAC3C,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,oBAAoB,CA2BtB;AAmCD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,kBAAkB,CASpB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,oBAAoB,CAEtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,oBAAoB,EAC/B,IAAI,CAAC,EAAE,MAAM,GACZ,QAAQ,GAAG,eAAe,CAI5B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GACrB,mBAAmB,GAAG,SAAS,CAEjC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,MAAM,CAaR;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAwC1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyC9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,mBAAmB,CAarB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,EACD,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CA8BR;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EACR,QAAQ,SAAS;IAAE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAE9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChE,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAS5D"}
+{"version":3,"file":"continuation-identity.d.ts","sourceRoot":"","sources":["../../src/internal/continuation-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,OAAO,GACP,QAAQ,GACR,WAAW,GACX,YAAY,CAAC;AAEjB,eAAO,MAAM,sBAAsB,YACjC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,2BAA2B,EAC3B,SAAS,EACT,SAAS,CACD,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AACxD,uEAAuE;AACvE,MAAM,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAC/C;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACpC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAC;IACpD,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,SAAS,mBAAmB,EAiDzC,CAAC;AAEX,qBAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA2BD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GACZ,KAAK,IAAI,oBAAoB,CAE/B;AAED,wBAAgB,2BAA2B,CACzC,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,GAAE,2BAAkC,EAC3C,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,oBAAoB,CA2BtB;AAmCD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED,wBAAgB,mBAAmB,CACjC,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,kBAAkB,CASpB;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,oBAAoB,EAC1B,IAAI,CAAC,EAAE,MAAM,GACZ,oBAAoB,CAEtB;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,oBAAoB,EAC/B,IAAI,CAAC,EAAE,MAAM,GACZ,QAAQ,GAAG,eAAe,CAI5B;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,cAAc,CAC5B,IAAI,EAAE,gBAAgB,GACrB,mBAAmB,GAAG,SAAS,CAEjC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,MAAM,CAaR;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAwC1D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,oBAAoB,CAAC;CACjC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyC9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAmBpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE,MAAM,GACZ,mBAAmB,CAarB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE;IACP,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C,EACD,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CA8BR;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EACR,QAAQ,SAAS;IAAE,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAAE,EAE9D,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,EAChE,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAS5D"}

package/dist/internal/continuation-identity.js

@@ -77,7 +77,9 @@ export const BUILTINS = [
     {
         type: "deployment",
         kind: "deployments",
-        events: ["deployment.created", "deployment.succeeded"],
+        // All three factory stream events carry `deploymentId`; keep in
+        // lockstep with the control plane's `conversation/deployments.ts`.
+        events: ["deployment.created", "deployment.succeeded", "deployment.failed"],
         format: "deployments:{deploymentId}",
     },
 ];

package/dist/internal/conversation-mirror.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conversation-mirror.d.ts","sourceRoot":"","sources":["../../src/internal/conversation-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAsB,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAYD,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,QAAQ,CAAC;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,+BAA+B,GACvC,kBAAkB,CAqMpB;AA6ED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC"}
+{"version":3,"file":"conversation-mirror.d.ts","sourceRoot":"","sources":["../../src/internal/conversation-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAsB,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAK5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAMhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAYD,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,QAAQ,CAAC;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,kEAAkE;AAClE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,+BAA+B,GACvC,kBAAkB,CAqMpB;AA6ED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAoBjC"}

package/dist/internal/conversation-mirror.js

@@ -293,14 +293,13 @@ export function selectConversationMirror(input) {
         return undefined;
     }
     const env = (_a = input.env) !== null && _a !== void 0 ? _a : process.env;
-    const frameworkStoreId = cursorFrameworkStoreSourceId(env);
-    if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined ||
-        frameworkStoreId === undefined) {
+    if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined) {
         return undefined;
     }
+    const envSnapshot = env;
     return createConversationMirror({
         sink: cursorHostedFiles({
-            storeSourceId: frameworkStoreId,
+            resolveStoreSourceId: () => cursorFrameworkStoreSourceId(envSnapshot),
             // Full chain (env → key file → stored login): frozen engines listen
             // unsigned and bind CURSOR_API_KEY_FILE at task time, after this sink
             // is constructed.

package/dist/internal/cursor/hosted-deployment-secrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+export declare const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export declare function refreshBoundDeploymentSecrets(path?: string): void;
+//# sourceMappingURL=hosted-deployment-secrets.d.ts.map

package/dist/internal/cursor/hosted-deployment-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-deployment-secrets.d.ts","sourceRoot":"","sources":["../../../src/internal/cursor/hosted-deployment-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,eAAO,MAAM,2CAA2C,4DACG,CAAC;AAqC5D;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,MAAoD,GACzD,IAAI,CAeN"}

package/dist/internal/cursor/hosted-deployment-secrets.js

@@ -0,0 +1,61 @@
+/**
+ * Task-time application secrets for hosted v2 freeze restores.
+ *
+ * The deployment host rewrites this tmpfs document before each admission and
+ * execution request. July reloads it synchronously because the process was
+ * already running in the frozen snapshot when the task-specific values
+ * arrived.
+ */
+import { readFileSync } from "node:fs";
+export const DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE = "/run/cursor/secrets/AGENT_SERVE_DEPLOYMENT_SECRETS.json";
+const SECRET_NAME_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
+const appliedSecretNames = new Set();
+function parseBoundSecrets(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (_a) {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return undefined;
+    }
+    const envelope = parsed;
+    if (envelope.v !== 1 ||
+        envelope.secrets === null ||
+        typeof envelope.secrets !== "object" ||
+        Array.isArray(envelope.secrets)) {
+        return undefined;
+    }
+    const secrets = {};
+    for (const [name, value] of Object.entries(envelope.secrets)) {
+        if (SECRET_NAME_PATTERN.test(name) &&
+            !name.startsWith("CURSOR_") &&
+            typeof value === "string") {
+            secrets[name] = value;
+        }
+    }
+    return secrets;
+}
+/**
+ * Refresh `process.env` from the latest bound document. A missing or malformed
+ * file is a no-op; an empty valid document removes values loaded by an earlier
+ * bind after the deployment secret was unset.
+ */
+export function refreshBoundDeploymentSecrets(path = DEFAULT_AGENT_SERVE_DEPLOYMENT_SECRETS_FILE) {
+    const secrets = parseBoundSecrets(path);
+    if (secrets === undefined) {
+        return;
+    }
+    for (const name of appliedSecretNames) {
+        if (!(name in secrets)) {
+            delete process.env[name];
+        }
+    }
+    appliedSecretNames.clear();
+    for (const [name, value] of Object.entries(secrets)) {
+        process.env[name] = value;
+        appliedSecretNames.add(name);
+    }
+}

package/dist/internal/cursor/hosted-store-secrets.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Task-time bind paths for hosted deployment file-store source ids.
+ *
+ * Freeze v2 snapshots start `agent-serve serve` at bake time without a service
+ * account, so neither store id is in process env. Execute-from-freeze binds
+ * the deployment credential and store ids into `/run/cursor/secrets/` without
+ * restarting July — the same pattern as {@link DEFAULT_CURSOR_API_KEY_FILE}.
+ */
+export declare const DEFAULT_AGENT_SERVE_STORE_SOURCE_ID_FILE = "/run/cursor/secrets/AGENT_SERVE_STORE_SOURCE_ID";
+export declare const DEFAULT_AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID_FILE = "/run/cursor/secrets/AGENT_SERVE_FRAMEWORK_STORE_SOURCE_ID";
+/** Deployment user-land store: env, then task-bind file. */
+export declare function resolveDeploymentStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
+/** Engine framework store: env, then task-bind file. */
+export declare function resolveFrameworkStoreSourceIdSync(env?: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=hosted-store-secrets.d.ts.map