@ory/amp 0.10.0

package/README.md

@@ -0,0 +1,120 @@
+# Ory Agent Plugin: Amp
+
+[Ory](https://ory.com) bundled into [Amp](https://ampcode.com) (Sourcegraph's coding agent): skills that scaffold Ory authentication into your codebase, a local Ory stack you can spin up in one command, and (when pointed at an Ory project) authentication, authorization, and audit for every tool Amp runs.
+
+You don't need an Ory account or any prior Ory experience to start.
+
+## New to Ory?
+
+[Ory](https://www.ory.com/docs/) is an open-source identity and access platform — login, registration, sessions, social sign-in, multi-factor auth, and fine-grained permissions, so you don't have to build any of that yourself. Two things make it easy to try with no prior experience:
+
+- **Ory Elements** are prebuilt, themeable UI components for the auth pages. The scaffolding skills wire them into your app for you.
+- **The local Ory stack** is a complete Ory running on your laptop in Docker — no account, no signup, no API key.
+
+## What this plugin does
+
+Two independent things, and you can use either on its own:
+
+1. **Build auth into your app.** Have Amp scaffold Ory login, registration, social sign-in, and permissions into the project you're working on, backed by the local stack. This needs nothing but Docker.
+2. **Govern the agent itself.** Authenticate Amp's own session and authorize every tool it runs against Ory Permissions, with a full audit trail. See [Agent security](#agent-security).
+
+## Prerequisites
+
+- [Amp](https://ampcode.com) installed
+- Node.js **≥ 22**
+- [Docker](https://docs.docker.com/get-docker/) (only needed for the local Ory stack)
+- macOS or Linux. Windows works via WSL2.
+
+## Install
+
+```bash
+npx -y -p @ory/amp ory-amp install
+```
+
+`install` performs two registrations and materializes the Ory skills:
+
+1. Registers the Ory **permission delegate** in Amp's settings (`~/.config/amp/settings.json`) under the flat top-level `amp.permissions` key as `{ tool: "*", action: "delegate", to: "ory-amp-permission" }` — this is the blocking gate.
+2. Writes the **in-process plugin** loader at `<project>/.amp/plugins/ory.ts` so Amp's Bun TypeScript runtime discovers it for session auth and audit tracing.
+
+The Ory skill playbooks land under `<project>/.agents/skills/` (Amp's project skills directory).
+
+```bash
+npx -y -p @ory/amp ory-amp status      # confirm delegate + plugin registration
+npx -y -p @ory/amp ory-amp uninstall   # remove the delegate, plugin, and skills
+```
+
+`status` prints configuration, user and agent identity, per-tool permission coverage, whether the delegate and in-process plugin are registered, and a tail of recent debug logs.
+
+## Quickstart (≈ 3 minutes)
+
+From any project where you'd like Ory authentication, inside Amp:
+
+1. **Start a local Ory instance.** Ask Amp *"start the local Ory stack"* or run `/local-up`. A banner prints the seeded test user's email and password — note them.
+2. **Scaffold Ory into your project.** Ask Amp *"add Ory auth to this app"* (the `ory-auth-setup` skill). It installs Ory Elements, wires the SDK, and generates the login / registration / recovery / settings pages, all targeting the local stack.
+3. **Sign in.** Start your app, visit the login page, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, zero configuration.
+
+Continue to [Agent security](#agent-security) when you're ready to enforce.
+
+## How the integration works
+
+Amp's Ory integration is a **hybrid** of two mechanisms:
+
+- **Blocking gate — a permission delegate helper (`ory-amp-permission`).** Registered in `amp.permissions`, Amp invokes it per tool call with the tool params on stdin and decides by **exit code**: `0` = allow, `1` = ask, `≥2` = reject (stderr is surfaced to the model). This is the only part that can block. Amp enforces a 10-second delegate timeout, so the Ory check fails open (allows) on slow or unreachable backends.
+- **Advisory in-process plugin (`.amp/plugins/ory.ts`).** Discovered by Amp's Bun runtime, it handles session-start auth (advisory — it cannot hard-block at session start) and post-tool audit tracing.
+
+The phases map as:
+
+- **Session start** (in-process plugin) — run the user and agent auth gates; advisory.
+- **Per-tool decision** (delegate) — check the tool against Ory Permissions; in enforce mode a deny exits `2` (reject), in observe mode it records a `permission.observe_deny` span and allows (exit `0`).
+- **Post-tool** (in-process plugin) — trace-only audit spans.
+
+The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config): the agent always starts, and enforcement is only as strong as your permission grants.
+
+## Agent security
+
+Once pointed at an Ory project (local or hosted), Amp's session and every tool call can be governed by Ory.
+
+- **Authentication.** The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is on (`ORY_USER_LOGIN=true`, off by default — browser PKCE flow on first session, persisted thereafter). The Amp process (the **agent**) gets its own OAuth2 identity via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
+- **Authorization.** Before any tool runs, the delegate checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject and rejects on `deny`.
+- **Audit.** Every decision is recorded as a structured trace span (NDJSON file and/or OTLP export).
+
+### Permission modes: observe → enforce
+
+After install the integration runs in **observe mode**: every tool call is checked, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway.
+
+```bash
+# Grant the current user `use` on every built-in tool (idempotent):
+npx -y -p @ory/amp ory-amp permissions bootstrap
+
+# See allowed/denied per tool:
+npx -y -p @ory/amp ory-amp permissions status
+
+# Turn on hard blocking once the observe-mode logs look right:
+npx -y -p @ory/amp ory-amp permissions enforce
+```
+
+Switch back any time with `permissions observe`. To disable Ory entirely (audit logging only), run `ory-amp configure --audit-only`.
+
+## Pointing at a real Ory project
+
+The Quickstart uses the local stack. To point at a hosted [Ory Network](https://console.ory.sh) project:
+
+```bash
+npx -y -p @ory/amp ory-amp configure \
+  --project-url https://<id>.projects.oryapis.com \
+  --oauth2-client-id <public OAuth2 client id>
+```
+
+`--oauth2-client-id` is required whenever `--project-url` is set — the user PKCE flow needs a public OAuth2 client registered with the four loopback redirect URIs (`http://127.0.0.1:47823..47826/callback`). See the [repo README](../../README.md) and [`AGENTS.md`](../../AGENTS.md) for the full environment-variable reference and permission-mode semantics. Config is shared across every Ory agent plugin at `~/.config/ory-agent-plugins/config.json`.
+
+Without configuration the plugin still loads cleanly and runs in **pass-through mode**: skills work, but nothing is blocked.
+
+## Links
+
+- [Ory documentation](https://www.ory.com/docs/)
+- [Amp documentation](https://ampcode.com)
+- [Repo README](../../README.md) and [AGENTS.md](../../AGENTS.md) — full env-var and permission-mode reference
+
+## License
+
+Apache-2.0

package/dist/cli/assets.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Materialize / clean the Ory skill catalog and command playbooks for the
+ * Amp plugin.
+ *
+ * Amp discovers project skills under `<projectDir>/.agents/skills/<name>/SKILL.md`
+ * (note `.agents`, not `.amp`; the amp-specific path is the user-global
+ * `~/.config/amp/skills/`). It has no project-scoped slash-command system, so
+ * the local-stack commands (local-up, local-down, temporal-up) are wrapped
+ * with `commandToSkill` and written alongside the guide skills as
+ * user-invocable skills — the same approach Codex and OpenClaw use.
+ */
+/**
+ * Write all Ory guide skills plus the command playbooks (wrapped as
+ * skills) under `<projectDir>/.agents/skills/`.
+ */
+export declare function installAmpOryAssets(projectDir: string): void;
+/** Remove every skill + command-skill this plugin installed. */
+export declare function uninstallAmpOryAssets(projectDir: string): void;

package/dist/cli/assets.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Materialize / clean the Ory skill catalog and command playbooks for the
+ * Amp plugin.
+ *
+ * Amp discovers project skills under `<projectDir>/.agents/skills/<name>/SKILL.md`
+ * (note `.agents`, not `.amp`; the amp-specific path is the user-global
+ * `~/.config/amp/skills/`). It has no project-scoped slash-command system, so
+ * the local-stack commands (local-up, local-down, temporal-up) are wrapped
+ * with `commandToSkill` and written alongside the guide skills as
+ * user-invocable skills — the same approach Codex and OpenClaw use.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAmpOryAssets = installAmpOryAssets;
+exports.uninstallAmpOryAssets = uninstallAmpOryAssets;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const RENDER_OPTS = {
+    binName: "ory-amp",
+    packageName: "@ory/amp",
+};
+/** Amp's project skills discovery directory: `<projectDir>/.agents/skills`. */
+function skillsRoot(projectDir) {
+    return path.join(projectDir, ".agents", "skills");
+}
+/**
+ * Write all Ory guide skills plus the command playbooks (wrapped as
+ * skills) under `<projectDir>/.agents/skills/`.
+ */
+function installAmpOryAssets(projectDir) {
+    const skillsDir = skillsRoot(projectDir);
+    fs.mkdirSync(skillsDir, { recursive: true });
+    const guideSkills = (0, argus_1.renderOrySkills)("amp", RENDER_OPTS);
+    const commandSkills = (0, argus_1.renderOryCommands)("amp", RENDER_OPTS).map(argus_1.commandToSkill);
+    (0, argus_1.writeSkillTree)(skillsDir, [...guideSkills, ...commandSkills]);
+}
+function safeRmEmpty(dir) {
+    try {
+        if (fs.existsSync(dir) && fs.readdirSync(dir).length === 0) {
+            fs.rmdirSync(dir);
+        }
+    }
+    catch {
+        /* ignore — leave the dir if removal fails. */
+    }
+}
+/** Remove every skill + command-skill this plugin installed. */
+function uninstallAmpOryAssets(projectDir) {
+    const skillsDir = skillsRoot(projectDir);
+    if (!fs.existsSync(skillsDir))
+        return;
+    (0, argus_1.removeSkillDirs)(skillsDir, argus_1.ORY_SKILL_NAMES);
+    (0, argus_1.removeSkillDirs)(skillsDir, argus_1.ORY_COMMAND_SKILL_NAMES);
+    safeRmEmpty(skillsDir);
+    // Clean up the parent `.agents` dir if we emptied it.
+    safeRmEmpty(path.dirname(skillsDir));
+}

package/dist/cli/main.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * Main CLI for @ory/amp.
+ *
+ * Usage:
+ *   npx ory-amp install [--project-dir <path>]    Register delegate + in-process plugin
+ *   npx ory-amp uninstall [--project-dir <path>]  Remove Ory entries
+ *   npx ory-amp configure                         Set or view Ory credentials
+ *   npx ory-amp setup [--project-dir <path>]      Write config directly (fallback)
+ *   npx ory-amp status                            Show plugin status
+ */
+export {};

package/dist/cli/main.js

@@ -0,0 +1,192 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Main CLI for @ory/amp.
+ *
+ * Usage:
+ *   npx ory-amp install [--project-dir <path>]    Register delegate + in-process plugin
+ *   npx ory-amp uninstall [--project-dir <path>]  Remove Ory entries
+ *   npx ory-amp configure                         Set or view Ory credentials
+ *   npx ory-amp setup [--project-dir <path>]      Write config directly (fallback)
+ *   npx ory-amp status                            Show plugin status
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const fs = __importStar(require("node:fs"));
+const argus_1 = require("@ory/argus");
+function main() {
+    const [command, ...args] = process.argv.slice(2);
+    switch (command) {
+        case "install":
+            install(args);
+            postInstallPermissions("ory-amp", "amp").then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "uninstall":
+            uninstall(args);
+            break;
+        case "configure":
+            (0, argus_1.runConfigureCommand)("ory-amp", args);
+            break;
+        case "agent":
+            (0, argus_1.runAgentCommand)("ory-amp", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "permissions":
+            (0, argus_1.runPermissionsCommand)("ory-amp", "amp", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "setup":
+            require("./setup.js");
+            break;
+        case "status":
+            status(args).then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-amp", args).catch((err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            help();
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            help();
+            process.exit(1);
+    }
+}
+/**
+ * Amp has no native plugin-registration CLI, so install delegates to the
+ * setup writer, which registers the permission delegate in Amp's settings
+ * and writes the in-process plugin loader at `.amp/plugins/ory.ts`.
+ */
+function install(args) {
+    process.argv = ["node", "setup.js", ...args];
+    require("./setup.js");
+    (0, argus_1.printEnvHelp)("ory-amp");
+}
+function uninstall(args) {
+    process.argv = ["node", "setup.js", "--uninstall", ...args];
+    require("./setup.js");
+}
+async function postInstallPermissions(binName, harness) {
+    const bootstrapped = await (0, argus_1.maybeAutoBootstrap)(binName, harness);
+    (0, argus_1.printPermissionsOnboardingHelp)(binName, harness, {
+        bootstrappedAutomatically: bootstrapped,
+    });
+}
+function parseProjectDir(args) {
+    const idx = args.indexOf("--project-dir");
+    if (idx !== -1 && args[idx + 1])
+        return args[idx + 1];
+    return process.cwd();
+}
+async function status(args) {
+    const projectDir = parseProjectDir(args);
+    // Setup writes the delegate to Amp's user-global settings file (the
+    // `--settings-file` default); the in-process loader lives under the
+    // project's `.amp/plugins/`.
+    const settingsPath = path.join(os.homedir(), ".config", "amp", "settings.json");
+    const pluginFile = path.join(projectDir, ".amp", "plugins", "ory.ts");
+    await (0, argus_1.runStatusCommand)("ory-amp", "amp", {
+        title: "Amp",
+        printPluginSection: () => {
+            console.log("Permission delegate & plugin:");
+            console.log(`  Settings file:    ${settingsPath}`);
+            let delegateRegistered = false;
+            try {
+                if (fs.existsSync(settingsPath)) {
+                    const raw = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+                    const perms = Array.isArray(raw["amp.permissions"])
+                        ? raw["amp.permissions"]
+                        : [];
+                    delegateRegistered = perms.some((p) => p?.to === "ory-amp-permission");
+                }
+            }
+            catch {
+                /* ignore parse errors */
+            }
+            console.log(`  Delegate:         ${delegateRegistered ? "registered (ory-amp-permission)" : "NOT registered"}`);
+            console.log(`  In-process plugin: ${fs.existsSync(pluginFile) ? `installed (${pluginFile})` : "not installed"}`);
+        },
+    });
+}
+function help() {
+    console.log(`
+ory-amp — Ory plugin for Amp (Sourcegraph's coding agent)
+
+Usage:
+  npx -y -p @ory/amp ory-amp <command> [options]
+
+Commands:
+  install [--project-dir <path>]   Register the permission delegate and in-process plugin
+  uninstall [--project-dir <path>] Remove the Ory delegate, plugin, and skills
+  configure                        Set or view Ory project URL and API key
+  agent <status|unregister>        Manage the agent's OAuth2 (DCR) identity
+  permissions <cmd>                Manage permission mode and tool permissions
+                                   (status, bootstrap, observe, enforce)
+  setup [--project-dir <path>]     Write config directly (fallback)
+  status [--project-dir <path>]    Show plugin configuration and status
+  local <cmd>                      Manage local Ory dev environment
+                                   (up, down, status, seed, logs, env, configure, reset)
+
+After installing, the Ory integration runs in two parts:
+  Permission delegate (ory-amp-permission)   Authorize each tool call (blocking)
+  In-process plugin (.amp/plugins/ory.ts)    Session auth + audit tracing
+
+Examples:
+  npx -y -p @ory/amp ory-amp install
+  npx -y -p @ory/amp ory-amp configure --project-url https://<id>.projects.oryapis.com
+  npx -y -p @ory/amp ory-amp permissions bootstrap
+  npx -y -p @ory/amp ory-amp status
+`);
+}
+main();

package/dist/cli/setup.d.ts

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Setup CLI for the Ory Amp plugin.
+ *
+ * Performs two installs:
+ *   (a) Registers the permission delegate in Amp's settings under
+ *       `amp.permissions` as `{ tool: "*", action: "delegate",
+ *       to: "ory-amp-permission" }` — this is the blocking gate.
+ *   (b) Writes the in-process plugin loader at
+ *       `<projectDir>/.amp/plugins/ory.ts` so Amp's Bun TypeScript runtime
+ *       discovers it for session auth + audit tracing.
+ *
+ * Usage:
+ *   npx ory-amp-setup                    # Auto-detect and configure
+ *   npx ory-amp-setup --project-dir /path/to/repo
+ *   npx ory-amp-setup --print            # Print config to stdout without writing
+ *   npx ory-amp-setup --uninstall        # Remove Ory entries from settings + plugins
+ *
+ * Verified against the installed `amp` binary: the default settings file is
+ * `~/.config/amp/settings.json` (the `--settings-file` default), with a flat
+ * top-level `amp.permissions` array of `{ tool, action, to }`. Amp also ships
+ * a native `amp permissions add <action> <tool> --to <program>` command (with
+ * `-w/--workspace` for project scope); the equivalent registration is:
+ *
+ *   amp permissions add delegate '*' --to ory-amp-permission
+ *
+ * This setup writes the same entry into settings.json directly so the flow
+ * works without shelling out. In-process plugins are discovered as direct
+ * `*.ts` files under `.amp/plugins/` (project) or `~/.config/amp/plugins/`
+ * (system), executed by Bun's TypeScript runtime.
+ */
+export {};

package/dist/cli/setup.js

@@ -0,0 +1,197 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Setup CLI for the Ory Amp plugin.
+ *
+ * Performs two installs:
+ *   (a) Registers the permission delegate in Amp's settings under
+ *       `amp.permissions` as `{ tool: "*", action: "delegate",
+ *       to: "ory-amp-permission" }` — this is the blocking gate.
+ *   (b) Writes the in-process plugin loader at
+ *       `<projectDir>/.amp/plugins/ory.ts` so Amp's Bun TypeScript runtime
+ *       discovers it for session auth + audit tracing.
+ *
+ * Usage:
+ *   npx ory-amp-setup                    # Auto-detect and configure
+ *   npx ory-amp-setup --project-dir /path/to/repo
+ *   npx ory-amp-setup --print            # Print config to stdout without writing
+ *   npx ory-amp-setup --uninstall        # Remove Ory entries from settings + plugins
+ *
+ * Verified against the installed `amp` binary: the default settings file is
+ * `~/.config/amp/settings.json` (the `--settings-file` default), with a flat
+ * top-level `amp.permissions` array of `{ tool, action, to }`. Amp also ships
+ * a native `amp permissions add <action> <tool> --to <program>` command (with
+ * `-w/--workspace` for project scope); the equivalent registration is:
+ *
+ *   amp permissions add delegate '*' --to ory-amp-permission
+ *
+ * This setup writes the same entry into settings.json directly so the flow
+ * works without shelling out. In-process plugins are discovered as direct
+ * `*.ts` files under `.amp/plugins/` (project) or `~/.config/amp/plugins/`
+ * (system), executed by Bun's TypeScript runtime.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+const PACKAGE_NAME = "@ory/amp";
+const DELEGATE_BIN = "ory-amp-permission";
+/** Direct *.ts loader Amp's Bun runtime discovers under .amp/plugins/. */
+const PLUGIN_FILE = "ory.ts";
+/**
+ * Read the plugin's own version, walking up from dist/cli to the package
+ * root. Used to version-pin the npx invocation written into the in-process
+ * plugin loader and any delegate references.
+ */
+function readPackageVersion() {
+    const pkgPath = path.resolve(__dirname, "..", "..", "package.json");
+    const raw = fs.readFileSync(pkgPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.version) {
+        throw new Error(`Could not read version from ${pkgPath}`);
+    }
+    return parsed.version;
+}
+function getSettingsPath(_args) {
+    // Verified: Amp's default settings file is the user-global
+    // ~/.config/amp/settings.json (the `--settings-file` default). Amp's own
+    // permission entries are global by default; `-w/--workspace` would scope
+    // them to the project. We follow the verified default.
+    return path.join(os.homedir(), ".config", "amp", "settings.json");
+}
+/**
+ * The `amp.permissions` delegate entry that routes every tool ("*") through
+ * the Ory permission helper. Amp invokes the named program with the tool
+ * params on stdin and reads the decision from the exit code.
+ *
+ * Verified against the binary: a flat top-level `amp.permissions` array of
+ * `{ tool, action, to }` entries.
+ */
+function delegateEntry() {
+    return { tool: "*", action: "delegate", to: DELEGATE_BIN };
+}
+function isOryDelegate(entry) {
+    return (typeof entry === "object" &&
+        entry !== null &&
+        entry.action === "delegate" &&
+        entry.to === DELEGATE_BIN);
+}
+function mergePermissions(existing) {
+    const merged = { ...existing };
+    const perms = (Array.isArray(merged["amp.permissions"])
+        ? merged["amp.permissions"]
+        : []).filter((e) => !isOryDelegate(e));
+    perms.push(delegateEntry());
+    merged["amp.permissions"] = perms;
+    return merged;
+}
+function removePermissions(existing) {
+    const merged = { ...existing };
+    const perms = (Array.isArray(merged["amp.permissions"])
+        ? merged["amp.permissions"]
+        : []).filter((e) => !isOryDelegate(e));
+    if (perms.length === 0) {
+        delete merged["amp.permissions"];
+    }
+    else {
+        merged["amp.permissions"] = perms;
+    }
+    return merged;
+}
+/**
+ * The in-process plugin loader written at `.amp/plugins/ory.ts`. Amp's Bun
+ * TypeScript runtime discovers direct `*.ts` files under `.amp/plugins/`, so
+ * this re-exports the installed `@ory/amp` package's default-exported plugin
+ * factory. Version-pinned in the header so the on-disk loader is traceable to
+ * the package the settings were written against.
+ */
+function pluginLoaderSource(version) {
+    return (`// Generated by ${PACKAGE_NAME}@${version} — do not edit by hand.\n` +
+        `// Re-exports the Ory in-process plugin for Amp's .amp/plugins/ loader.\n` +
+        `export { default } from "${PACKAGE_NAME}";\n`);
+}
+function getPluginFile(args) {
+    return path.join(args.projectDir, ".amp", "plugins", PLUGIN_FILE);
+}
+function main() {
+    if (process.argv.includes("--help") || process.argv.includes("-h")) {
+        (0, argus_1.printSetupHelp)("ory-amp-setup", "Amp");
+        process.exit(0);
+    }
+    const args = (0, argus_1.parseSetupArgs)();
+    const version = readPackageVersion();
+    if (args.print) {
+        console.log(JSON.stringify({ "amp.permissions": [delegateEntry()] }, null, 2));
+        return;
+    }
+    const settingsPath = getSettingsPath(args);
+    const pluginFile = getPluginFile(args);
+    const skillsDir = path.join(args.projectDir, ".agents", "skills");
+    const existing = (0, argus_1.readJsonFile)(settingsPath);
+    if (args.uninstall) {
+        if (fs.existsSync(settingsPath)) {
+            const updated = removePermissions(existing);
+            (0, argus_1.writeJsonFile)(settingsPath, updated);
+            console.log(`Removed Ory permission delegate from ${settingsPath}`);
+        }
+        else {
+            console.log("No Amp settings file found. Nothing to remove from settings.");
+        }
+        if (fs.existsSync(pluginFile)) {
+            fs.rmSync(pluginFile, { force: true });
+            console.log(`Removed Ory in-process plugin from ${pluginFile}`);
+        }
+        (0, assets_js_1.uninstallAmpOryAssets)(args.projectDir);
+        console.log(`Removed Ory skills from ${skillsDir}`);
+        return;
+    }
+    // (a) Register the permission delegate (blocking gate).
+    const merged = mergePermissions(existing);
+    (0, argus_1.writeJsonFile)(settingsPath, merged);
+    // (b) Write the in-process plugin loader (auth + tracing).
+    fs.mkdirSync(path.dirname(pluginFile), { recursive: true });
+    fs.writeFileSync(pluginFile, pluginLoaderSource(version));
+    // (c) Materialize the Ory skill catalog.
+    (0, assets_js_1.installAmpOryAssets)(args.projectDir);
+    console.log(`Ory permission delegate registered in ${settingsPath}`);
+    console.log(`  Delegate: ${DELEGATE_BIN} (tool: "*", action: delegate)`);
+    console.log(`Ory in-process plugin written to ${pluginFile}`);
+    console.log(`Ory skills installed under ${skillsDir}`);
+    (0, argus_1.printNextSteps)("Amp", "npx ory-amp-setup --uninstall");
+}
+main();

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+import { createOryPlugin } from "./plugin.js";
+export { createOryPlugin };
+export type { CreateOryPluginDeps } from "./plugin.js";
+export { decideToolPermission, extractToolName, type DelegateDecision } from "./permission.js";
+export type { AmpPlugin, AmpPluginApi, AmpPluginEventContext, AmpEvent, AmpEventMap, AmpDelegateInput, AmpToolCallResult, AmpSessionStartEvent, AmpToolResultEvent, } from "./types.js";
+declare const _default: import("./types.js").AmpPlugin;
+export default _default;