@ory/argus 0.1.0 → 0.1.2

package/assets/commands/local-down.md

@@ -7,7 +7,7 @@ preserving data volumes so you can restart later without losing state.
 Run:
 
 ```bash
-npx {{BIN}} local down
+{{NPX}} local down
 ```
 
 To restart later, use {{REF_LOCAL_UP}}.
@@ -15,5 +15,5 @@ To restart later, use {{REF_LOCAL_UP}}.
 To stop **and** remove all data (full reset), run:
 
 ```bash
-npx {{BIN}} local reset
+{{NPX}} local reset
 ```

package/assets/commands/local-up.md

@@ -7,7 +7,7 @@ and an Nginx gateway on port 4000.
 Run:
 
 ```bash
-npx {{BIN}} local up
+{{NPX}} local up
 ```
 
 This will:
@@ -20,8 +20,8 @@ This will:
 After it completes, set the printed environment variables in your shell:
 
 ```bash
-eval "$(npx {{BIN}} local env)"
+eval "$({{NPX}} local env)"
 ```
 
 If services are already running, stop them first with {{REF_LOCAL_DOWN}}
-or use `npx {{BIN}} local status` to check the current state.
+or use `{{NPX}} local status` to check the current state.

package/assets/skills/local-dev/SKILL.md

@@ -14,7 +14,7 @@ manage the lifecycle:
   then seed a test identity, session, and permission tuples.
 - {{REF_LOCAL_DOWN}} — stop all services while preserving data volumes.
 
-Both delegate to `npx {{BIN}} local <subcommand>`, so the same
+Both delegate to `{{NPX}} local <subcommand>`, so the same
 workflow runs from the shell when the command shortcuts are not available.
 
 ## When to use this skill
@@ -69,7 +69,7 @@ docker engine) and retry. Do not try to install Docker for them.
 Tell the user to run {{REF_LOCAL_UP}}, or the equivalent shell command:
 
 ```bash
-npx {{BIN}} local up
+{{NPX}} local up
 ```
 
 Wait for the command to print "All services are running!" and the seed
@@ -79,7 +79,7 @@ output. Capture two values from the output:
 - `ORY_SESSION_TOKEN` (the seeded session token)
 
 If the user wants to skip seeding (to bring their own data), use
-`npx {{BIN}} local up --no-seed` instead.
+`{{NPX}} local up --no-seed` instead.
 
 ## Step 3: Point the app at the local gateway
 
@@ -102,7 +102,7 @@ same value as `basePath` in the Ory `Configuration`.
 machine target the local stack):
 
 ```bash
-npx {{BIN}} local configure
+{{NPX}} local configure
 ```
 
 This writes the URL to the shared plugin config so future agent runs
@@ -148,10 +148,10 @@ Common day-to-day commands:
 
 | Need                           | Command                                  |
 |--------------------------------|------------------------------------------|
-| Re-seed (after `local reset`)  | `npx {{BIN}} local seed`              |
-| Tail Kratos logs               | `npx {{BIN}} local logs kratos -f`    |
-| Check what's running           | `npx {{BIN}} local status`            |
-| Print env vars to copy/paste   | `npx {{BIN}} local env`               |
+| Re-seed (after `local reset`)  | `{{NPX}} local seed`              |
+| Tail Kratos logs               | `{{NPX}} local logs kratos -f`    |
+| Check what's running           | `{{NPX}} local status`            |
+| Print env vars to copy/paste   | `{{NPX}} local env`               |
 
 If the user reports flaky behavior, run `local status` first to confirm
 each service is `healthy`. If a container is unhealthy, `local logs
@@ -161,14 +161,14 @@ have looked at logs.
 ## Step 7: Stop or reset
 
 When the user is done for the session, use {{REF_LOCAL_DOWN}} (equivalent:
-`npx {{BIN}} local down`). Containers stop but volumes
+`{{NPX}} local down`). Containers stop but volumes
 remain, so the next {{REF_LOCAL_UP}} reuses the same identities,
 sessions, and tuples.
 
 For a full wipe (e.g., after schema changes or to clear test data):
 
 ```bash
-npx {{BIN}} local reset
+{{NPX}} local reset
 ```
 
 `reset` removes data volumes and the generated `.ory-dev/ory/` directory.
@@ -179,8 +179,8 @@ plugin updates the bundled service configs.
 
 - **"Docker is not running"** — start Docker Desktop, then re-run
   {{REF_LOCAL_UP}}.
-- **Gateway never becomes healthy** — `npx {{BIN}} local logs
-  gateway` and `npx {{BIN}} local logs kratos` to see which service
+- **Gateway never becomes healthy** — `{{NPX}} local logs
+  gateway` and `{{NPX}} local logs kratos` to see which service
   failed. Port conflicts on `4000`, `4433`, `4444`, or `4466` are the
   usual culprit.
 - **Login works but `whoami` returns 401** — the cookie domain is

package/dist/dev.js

@@ -127,8 +127,19 @@ function npmEnv() {
     // the local registry through an isolated pacote cache, with the user's
     // supply-chain freshness gate disabled (otherwise just-published tarballs
     // get filtered out as `ENOVERSIONS — No versions available`).
+    //
+    // `npm_config_userconfig` swaps the userconfig file from `~/.npmrc` to a
+    // launcher-managed npmrc that pins `@ory:registry` to the local Verdaccio.
+    // Without this, a developer-level `@ory:registry=…` line in their own
+    // `~/.npmrc` (left over from `npm login --scope=@ory` or similar) wins
+    // against `--registry` for scoped packages and routes the launcher's
+    // `npm install @ory/<harness>` — and the harness's own runtime `npx`
+    // calls — back to npmjs.org. The symptoms are ENOVERSIONS or tarball
+    // sha512 corruption depending on which side of the manifest/tarball
+    // split each subprocess hits.
     return {
         ...process.env,
+        npm_config_userconfig: (0, manager_js_1.ensureLauncherNpmrc)(),
         npm_config_registry: config_js_1.REGISTRY_URL,
         npm_config_cache: (0, manager_js_1.getLocalRegistryNpmCacheDir)(),
         npm_config_min_release_age: "0",

package/dist/registry/config.d.ts

@@ -21,3 +21,20 @@ export declare const REGISTRY_CONTAINER_STORAGE = "/verdaccio/storage";
 export declare const REGISTRY_CONTAINER_CONFIG = "/verdaccio/conf/config.yaml";
 export declare function verdaccioConfigYaml(): string;
 export declare function npmrcContent(): string;
+/**
+ * Userconfig file used by the dev launcher's npm/npx subprocesses.
+ *
+ * The scope-specific `@ory:registry=…` line is the critical bit. If a
+ * developer has ever run `npm login --scope=@ory` (or otherwise pinned
+ * `@ory:registry` in their `~/.npmrc`) to publish or fetch from npmjs.org,
+ * that pin takes precedence over `--registry` / `npm_config_registry` for
+ * scoped packages — so the launcher's `npm install @ory/<harness>` and the
+ * harness's own runtime `npx -y -p @ory/<harness>` calls silently hit
+ * npmjs.org instead of localhost, producing either `ENOVERSIONS` (because
+ * npmjs's manifest doesn't list the just-bumped local version) or a tarball
+ * sha512 mismatch (when the local manifest is consulted but npmjs serves
+ * the bytes). We expose this file as `npm_config_userconfig` so it
+ * displaces `~/.npmrc` entirely for subprocesses the launcher spawns,
+ * without modifying any global config or polluting the sandbox.
+ */
+export declare function launcherNpmrcContent(): string;

package/dist/registry/config.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.REGISTRY_CONTAINER_CONFIG = exports.REGISTRY_CONTAINER_STORAGE = exports.REGISTRY_CONTAINER = exports.REGISTRY_IMAGE = exports.REGISTRY_DIR_NAME = exports.REGISTRY_URL = exports.REGISTRY_PORT = void 0;
 exports.verdaccioConfigYaml = verdaccioConfigYaml;
 exports.npmrcContent = npmrcContent;
+exports.launcherNpmrcContent = launcherNpmrcContent;
 exports.REGISTRY_PORT = 4873;
 exports.REGISTRY_URL = `http://localhost:${exports.REGISTRY_PORT}`;
 exports.REGISTRY_DIR_NAME = ".ory-dev/registry";
@@ -44,15 +45,22 @@ uplinks:
     cache: false
 
 packages:
+  # @ory/client is a transitive Ory SDK dep that lives on npmjs.org — proxy
+  # it so installs can resolve it from upstream.
+  "@ory/client":
+    access: $all
+    publish: $all
+    proxy: npmjs
+
+  # All other @ory/* packages are workspace packages we publish locally.
+  # No proxy: if upstream were consulted, Verdaccio would merge npmjs.org's
+  # already-published versions into the manifest and reject every republish
+  # at the same version with "cannot publish over previously published
+  # versions: X.Y.Z".
   "@ory/*":
     access: $all
     publish: $all
     unpublish: $all
-    # Locally-published workspace packages (e.g. @ory/argus) are served from
-    # storage; everything else under @ory/* (notably @ory/client, a transitive
-    # dep) falls through to npmjs. Without this, transitive @ory/client
-    # resolution fails with E404 against the local registry.
-    proxy: npmjs
 
   "**":
     access: $all
@@ -78,3 +86,26 @@ function npmrcContent() {
 //localhost:${exports.REGISTRY_PORT}/:_authToken=local-dev-token
 `;
 }
+/**
+ * Userconfig file used by the dev launcher's npm/npx subprocesses.
+ *
+ * The scope-specific `@ory:registry=…` line is the critical bit. If a
+ * developer has ever run `npm login --scope=@ory` (or otherwise pinned
+ * `@ory:registry` in their `~/.npmrc`) to publish or fetch from npmjs.org,
+ * that pin takes precedence over `--registry` / `npm_config_registry` for
+ * scoped packages — so the launcher's `npm install @ory/<harness>` and the
+ * harness's own runtime `npx -y -p @ory/<harness>` calls silently hit
+ * npmjs.org instead of localhost, producing either `ENOVERSIONS` (because
+ * npmjs's manifest doesn't list the just-bumped local version) or a tarball
+ * sha512 mismatch (when the local manifest is consulted but npmjs serves
+ * the bytes). We expose this file as `npm_config_userconfig` so it
+ * displaces `~/.npmrc` entirely for subprocesses the launcher spawns,
+ * without modifying any global config or polluting the sandbox.
+ */
+function launcherNpmrcContent() {
+    return `registry=${exports.REGISTRY_URL}/
+@ory:registry=${exports.REGISTRY_URL}/
+//localhost:${exports.REGISTRY_PORT}/:_authToken=local-dev-token
+min-release-age=0
+`;
+}

package/dist/registry/manager.d.ts

@@ -19,6 +19,17 @@
  * pnpm publish/npm install even after we drop the version from Verdaccio.
  */
 export declare function getLocalRegistryNpmCacheDir(): string;
+/**
+ * Path to the userconfig npmrc the dev launcher hands to its subprocesses.
+ * See `launcherNpmrcContent` in `./config.ts` for why this exists.
+ */
+export declare function getLauncherNpmrcPath(): string;
+/**
+ * Materialize the launcher userconfig npmrc on disk and return its path.
+ * Idempotent: rewrites the file every call so any drift in the rendered
+ * content (e.g. registry URL change) lands without a clean-and-restart.
+ */
+export declare function ensureLauncherNpmrc(): string;
 /**
  * Start the local registry if it isn't already running.
  */

package/dist/registry/manager.js

@@ -46,6 +46,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLocalRegistryNpmCacheDir = getLocalRegistryNpmCacheDir;
+exports.getLauncherNpmrcPath = getLauncherNpmrcPath;
+exports.ensureLauncherNpmrc = ensureLauncherNpmrc;
 exports.ensureRegistryRunning = ensureRegistryRunning;
 exports.publishHarnessToLocal = publishHarnessToLocal;
 exports.registryStart = registryStart;
@@ -84,6 +86,24 @@ function getRegistryDir() {
 function getLocalRegistryNpmCacheDir() {
     return path.join(getRegistryDir(), "npm-cache");
 }
+/**
+ * Path to the userconfig npmrc the dev launcher hands to its subprocesses.
+ * See `launcherNpmrcContent` in `./config.ts` for why this exists.
+ */
+function getLauncherNpmrcPath() {
+    return path.join(getRegistryDir(), "launcher.npmrc");
+}
+/**
+ * Materialize the launcher userconfig npmrc on disk and return its path.
+ * Idempotent: rewrites the file every call so any drift in the rendered
+ * content (e.g. registry URL change) lands without a clean-and-restart.
+ */
+function ensureLauncherNpmrc() {
+    const npmrcPath = getLauncherNpmrcPath();
+    ensureDir(path.dirname(npmrcPath));
+    fs.writeFileSync(npmrcPath, (0, config_js_1.launcherNpmrcContent)());
+    return npmrcPath;
+}
 function ensureDir(dir) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -176,15 +196,28 @@ async function withLocalPublishConfig(workspaceRoot, fn) {
 async function cleanScopeStorage() {
     // Verdaccio caches package metadata in memory; deleting on-disk storage
     // alone leaves stale manifests served and causes publish to report
-    // "already exists". Issue an HTTP DELETE for every known scoped package
-    // first (Verdaccio drops both memory + disk state), then remove any
-    // residual scope dir for completeness.
+    // "already exists". Issue an authenticated HTTP DELETE for every known
+    // scoped package first (Verdaccio drops both memory + disk state), then
+    // remove any residual scope dir for completeness.
+    //
+    // The Authorization header is required: Verdaccio silently rejects
+    // unauthenticated DELETEs, leaves its in-memory manifest intact, and then
+    // rewrites the on-disk `package.json` from that cache on the next publish
+    // — so the second publish sees the stale versions and fails with
+    // "cannot publish over previously published versions".
     const root = findProjectRoot(process.cwd());
     const names = listWorkspaceScopedPackages(root);
+    const token = readToken(getRegistryDir());
+    const headers = token
+        ? { Authorization: `Bearer ${token}` }
+        : {};
     await Promise.all(names.map(async (name) => {
         const encoded = name.replace("/", "%2f");
         try {
-            await fetch(`${config_js_1.REGISTRY_URL}/${encoded}/-rev/0`, { method: "DELETE" });
+            await fetch(`${config_js_1.REGISTRY_URL}/${encoded}/-rev/0`, {
+                method: "DELETE",
+                headers,
+            });
         }
         catch {
             // Best-effort.
@@ -292,6 +325,48 @@ async function registerDevUser(registryDir) {
     fs.writeFileSync(getTokenFile(registryDir), token);
     return token;
 }
+/**
+ * Restart the registry container if the rendered Verdaccio config has
+ * drifted from what's on disk. Verdaccio 6 does not hot-reload `config.yaml`,
+ * so a config change in the codebase has no effect on a running container
+ * until it restarts — and a stale config can silently keep mis-routing
+ * publishes through the upstream proxy. Called from `publishAllOryToLocal`
+ * so any code-bundled policy fix lands without an explicit `registry:clean`.
+ */
+async function ensureConfigInSync(quiet) {
+    const registryDir = getRegistryDir();
+    // If the registry dir doesn't exist here, the running container was
+    // started from a different cwd (e.g. main repo while we're in a worktree,
+    // or vice versa). We don't own the on-disk state and writing a config
+    // file at this path wouldn't reach the container's bind mount anyway.
+    // Skip silently — the downstream auth-token check will surface a clear
+    // error if the caller actually needs local registry state.
+    if (!fs.existsSync(registryDir))
+        return;
+    const configPath = path.join(registryDir, "config.yaml");
+    const expected = (0, config_js_1.verdaccioConfigYaml)();
+    const current = fs.existsSync(configPath)
+        ? fs.readFileSync(configPath, "utf-8")
+        : "";
+    if (current === expected)
+        return;
+    if (!quiet) {
+        console.log("Verdaccio config out of date — restarting registry...");
+    }
+    fs.writeFileSync(configPath, expected);
+    const restart = (0, node_child_process_1.spawnSync)("docker", ["restart", config_js_1.REGISTRY_CONTAINER], {
+        stdio: ["ignore", "ignore", "pipe"],
+        encoding: "utf-8",
+    });
+    if (restart.status !== 0) {
+        const stderr = (restart.stderr ?? "").toString().trim();
+        throw new Error(`Failed to restart registry container after config change (exit ${restart.status}): ${stderr}`);
+    }
+    const ready = await waitForRegistry();
+    if (!ready) {
+        throw new Error("Registry did not come back online after config restart within 30 seconds.");
+    }
+}
 // ─── Public lifecycle ──────────────────────────────────────────────
 /**
  * Start the local registry if it isn't already running.
@@ -362,6 +437,7 @@ async function publishAllOryToLocal(opts = {}) {
     if (!isRegistryRunning()) {
         throw new Error("Local registry is not running. Call ensureRegistryRunning() first.");
     }
+    await ensureConfigInSync(opts.quiet);
     const registryDir = getRegistryDir();
     const token = readToken(registryDir);
     if (!token) {
@@ -401,7 +477,25 @@ async function publishAllOryToLocal(opts = {}) {
             if (!fs.existsSync(tarball)) {
                 throw new Error(`Packed ${pkgName} but expected tarball not found at ${tarball}.`);
             }
-            const publishResult = (0, node_child_process_1.spawnSync)("npm", ["publish", tarball, "--registry", config_js_1.REGISTRY_URL, "--access=public"], {
+            // Scope-specific registry override. A developer who has run
+            // `npm login --scope=@ory` (or otherwise set `@ory:registry=…` in
+            // `~/.npmrc`) has a scope-pinned registry that takes precedence
+            // over `--registry` / `npm_config_registry` for scoped publishes.
+            // Without this flag, `npm publish` of an `@ory/*` tarball would
+            // silently target npmjs.org instead of localhost even though we
+            // strip `publishConfig.registry` and pass `--registry`.
+            const scope = packageScope(pkgName);
+            const scopeRegistryArg = scope
+                ? [`--${scope}:registry=${config_js_1.REGISTRY_URL}`]
+                : [];
+            const publishResult = (0, node_child_process_1.spawnSync)("npm", [
+                "publish",
+                tarball,
+                "--registry",
+                config_js_1.REGISTRY_URL,
+                ...scopeRegistryArg,
+                "--access=public",
+            ], {
                 cwd: pkgDir,
                 stdio: opts.quiet ? "pipe" : "inherit",
                 encoding: "utf-8",
@@ -434,6 +528,14 @@ function readPackageNameVersion(pkgJsonPath) {
 function tarballFilename(pkgName, version) {
     return `${pkgName.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
 }
+function packageScope(pkgName) {
+    if (!pkgName.startsWith("@"))
+        return null;
+    const slash = pkgName.indexOf("/");
+    if (slash < 0)
+        return null;
+    return pkgName.slice(0, slash);
+}
 function emitCapturedOutput(quiet, label, result) {
     if (!quiet)
         return;

package/dist/skills.js

@@ -126,6 +126,7 @@ function buildProfile(harness, opts) {
         tokens: {
             "{{BIN}}": opts.binName,
             "{{PKG}}": opts.packageName,
+            "{{NPX}}": `npx -y -p ${opts.packageName} ${opts.binName}`,
             "{{REF_AUTH_SETUP}}": skillRef("ory-auth-setup"),
             "{{REF_LOGIN_FLOW}}": skillRef("ory-login-flow"),
             "{{REF_SOCIAL_LOGIN}}": skillRef("ory-social-login"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -44,7 +44,9 @@
     "hydra"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",