@ory/argus 0.1.0

package/dist/otel/exporter.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Span exporter contract.
+ *
+ * Implementations ship completed TraceSpan records to an external trace
+ * sink (OTLP collector, vendor backend, in-process pipeline, etc.).
+ *
+ * Exporters must never throw. Transport failures, malformed responses,
+ * and shutdown races are all swallowed and logged through whatever
+ * channel the implementation chooses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/otel/index.d.ts

@@ -0,0 +1,2 @@
+export type { SpanExporter } from "./exporter.js";
+export { OtlpHttpExporter, otlpExporterFromEnv, buildExportRequest, parseKeyValueList, type OtlpHttpExporterOptions, } from "./otlp-http.js";

package/dist/otel/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyValueList = exports.buildExportRequest = exports.otlpExporterFromEnv = exports.OtlpHttpExporter = void 0;
+var otlp_http_js_1 = require("./otlp-http.js");
+Object.defineProperty(exports, "OtlpHttpExporter", { enumerable: true, get: function () { return otlp_http_js_1.OtlpHttpExporter; } });
+Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return otlp_http_js_1.otlpExporterFromEnv; } });
+Object.defineProperty(exports, "buildExportRequest", { enumerable: true, get: function () { return otlp_http_js_1.buildExportRequest; } });
+Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return otlp_http_js_1.parseKeyValueList; } });

package/dist/otel/otlp-http.d.ts

@@ -0,0 +1,116 @@
+/**
+ * OTLP/HTTP JSON exporter.
+ *
+ * Serializes TraceSpan records into the OTLP ExportTraceServiceRequest
+ * shape and POSTs them to an OTLP HTTP endpoint as JSON. Works with
+ * Jaeger's OTLP receiver, Grafana Tempo, OpenTelemetry Collector,
+ * Honeycomb, and any other vendor that accepts OTLP/HTTP.
+ *
+ * No protobuf dependency — relies on the global `fetch`. The exporter
+ * is intentionally side-effect-free: failures are swallowed (callers
+ * receive a resolved Promise) so trace export can never break the
+ * agent session.
+ *
+ * Standard env vars consumed by `otlpExporterFromEnv()`:
+ *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
+ *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
+ *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
+ *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    headers specific to traces
+ *   - OTEL_SERVICE_NAME                    service.name resource attribute
+ *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attrs
+ */
+import type { SpanExporter } from "./exporter.js";
+import type { TraceSpan } from "../tracer.js";
+export interface OtlpHttpExporterOptions {
+    /** Full traces endpoint (e.g. `http://localhost:4318/v1/traces`). */
+    endpoint: string;
+    /** Additional HTTP headers to send with each request. */
+    headers?: Record<string, string>;
+    /** Resource attributes (service.name, host.name, …) merged into every export. */
+    resource?: Record<string, AttributeValue>;
+    /** Per-request timeout in milliseconds. Default: 5000. */
+    timeoutMs?: number;
+    /** Optional sink for transport errors. Defaults to a no-op. */
+    onError?: (err: unknown) => void;
+    /**
+     * Override the fetch function (used by tests). Defaults to global fetch.
+     */
+    fetch?: typeof fetch;
+}
+export declare class OtlpHttpExporter implements SpanExporter {
+    private readonly endpoint;
+    private readonly headers;
+    private readonly resource;
+    private readonly timeoutMs;
+    private readonly onError;
+    private readonly fetchImpl;
+    private readonly inFlight;
+    constructor(opts: OtlpHttpExporterOptions);
+    export(spans: ReadonlyArray<TraceSpan>): Promise<void>;
+    private send;
+    shutdown(): Promise<void>;
+}
+/**
+ * Build an OtlpHttpExporter from process env. Returns undefined when no
+ * endpoint is configured.
+ */
+export declare function otlpExporterFromEnv(opts: {
+    harness: string;
+    hostname?: string;
+    user?: string;
+    pluginVersion?: string;
+    cwd?: string;
+    gitBranch?: string;
+    gitCommit?: string;
+    onError?: (err: unknown) => void;
+    env?: NodeJS.ProcessEnv;
+}): OtlpHttpExporter | undefined;
+/**
+ * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
+ */
+export declare function parseKeyValueList(raw: string | undefined): Record<string, string>;
+type AttributeValue = string | number | boolean | null | undefined;
+interface OtlpKeyValue {
+    key: string;
+    value: OtlpAnyValue;
+}
+interface OtlpAnyValue {
+    stringValue?: string;
+    intValue?: string;
+    doubleValue?: number;
+    boolValue?: boolean;
+    arrayValue?: {
+        values: OtlpAnyValue[];
+    };
+}
+interface OtlpStatus {
+    code: 0 | 1 | 2;
+    message?: string;
+}
+interface OtlpSpan {
+    traceId: string;
+    spanId: string;
+    parentSpanId?: string;
+    name: string;
+    kind: number;
+    startTimeUnixNano: string;
+    endTimeUnixNano: string;
+    attributes?: OtlpKeyValue[];
+    status?: OtlpStatus;
+}
+interface OtlpResourceSpans {
+    resource: {
+        attributes: OtlpKeyValue[];
+    };
+    scopeSpans: Array<{
+        scope: {
+            name: string;
+        };
+        spans: OtlpSpan[];
+    }>;
+}
+interface OtlpExportRequest {
+    resourceSpans: OtlpResourceSpans[];
+}
+export declare function buildExportRequest(spans: ReadonlyArray<TraceSpan>, resource: Record<string, AttributeValue>): OtlpExportRequest;
+export {};

package/dist/otel/otlp-http.js

@@ -0,0 +1,322 @@
+"use strict";
+/**
+ * OTLP/HTTP JSON exporter.
+ *
+ * Serializes TraceSpan records into the OTLP ExportTraceServiceRequest
+ * shape and POSTs them to an OTLP HTTP endpoint as JSON. Works with
+ * Jaeger's OTLP receiver, Grafana Tempo, OpenTelemetry Collector,
+ * Honeycomb, and any other vendor that accepts OTLP/HTTP.
+ *
+ * No protobuf dependency — relies on the global `fetch`. The exporter
+ * is intentionally side-effect-free: failures are swallowed (callers
+ * receive a resolved Promise) so trace export can never break the
+ * agent session.
+ *
+ * Standard env vars consumed by `otlpExporterFromEnv()`:
+ *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
+ *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
+ *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
+ *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    headers specific to traces
+ *   - OTEL_SERVICE_NAME                    service.name resource attribute
+ *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attrs
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtlpHttpExporter = void 0;
+exports.otlpExporterFromEnv = otlpExporterFromEnv;
+exports.parseKeyValueList = parseKeyValueList;
+exports.buildExportRequest = buildExportRequest;
+const TRACES_PATH = "/v1/traces";
+const SCOPE_NAME = "ory-agent-plugins";
+class OtlpHttpExporter {
+    endpoint;
+    headers;
+    resource;
+    timeoutMs;
+    onError;
+    fetchImpl;
+    inFlight = new Set();
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.headers = { "content-type": "application/json", ...opts.headers };
+        this.resource = opts.resource ?? {};
+        this.timeoutMs = opts.timeoutMs ?? 5_000;
+        this.onError = opts.onError ?? (() => undefined);
+        this.fetchImpl = opts.fetch ?? globalThis.fetch;
+    }
+    export(spans) {
+        if (spans.length === 0)
+            return Promise.resolve();
+        if (typeof this.fetchImpl !== "function") {
+            this.onError(new Error("global fetch is not available"));
+            return Promise.resolve();
+        }
+        const promise = this.send(spans);
+        this.inFlight.add(promise);
+        promise.finally(() => this.inFlight.delete(promise));
+        return promise;
+    }
+    async send(spans) {
+        const payload = buildExportRequest(spans, this.resource);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(this.endpoint, {
+                method: "POST",
+                headers: this.headers,
+                body: JSON.stringify(payload),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                // Drain body so the connection can be reused but ignore the value.
+                try {
+                    await response.text();
+                }
+                catch {
+                    /* ignore */
+                }
+                this.onError(new Error(`OTLP export failed with status ${response.status}`));
+            }
+        }
+        catch (err) {
+            this.onError(err);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async shutdown() {
+        // Drain in-flight exports. Subprocess hooks (claude-code, codex,
+        // gemini-cli) call process.exit() the instant they hand back stdout —
+        // without this drain the OTLP fetch is killed mid-flight and spans
+        // never reach the collector even though the NDJSON file already
+        // contains them.
+        if (this.inFlight.size === 0)
+            return;
+        await Promise.allSettled([...this.inFlight]);
+    }
+}
+exports.OtlpHttpExporter = OtlpHttpExporter;
+/**
+ * Build an OtlpHttpExporter from process env. Returns undefined when no
+ * endpoint is configured.
+ */
+function otlpExporterFromEnv(opts) {
+    const env = opts.env ?? process.env;
+    const endpoint = resolveEndpoint(env);
+    if (!endpoint)
+        return undefined;
+    const protocol = env.OTEL_EXPORTER_OTLP_PROTOCOL ?? env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL;
+    if (protocol && protocol !== "http/json") {
+        opts.onError?.(new Error(`OTEL_EXPORTER_OTLP_PROTOCOL=${protocol} not supported (only http/json). Skipping OTel export.`));
+        return undefined;
+    }
+    const headers = mergeHeaders(parseKeyValueList(env.OTEL_EXPORTER_OTLP_HEADERS), parseKeyValueList(env.OTEL_EXPORTER_OTLP_TRACES_HEADERS));
+    const resource = {
+        "service.name": env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${opts.harness}`,
+        "service.namespace": "ory.agent_plugins",
+        "ory.harness": opts.harness,
+        "process.pid": process.pid,
+        "process.runtime.name": "nodejs",
+        "process.runtime.version": process.version,
+    };
+    if (opts.hostname)
+        resource["host.name"] = opts.hostname;
+    if (opts.user)
+        resource["host.user"] = opts.user;
+    if (opts.pluginVersion) {
+        resource["service.version"] = opts.pluginVersion;
+    }
+    if (opts.cwd)
+        resource["process.cwd"] = opts.cwd;
+    if (opts.gitBranch)
+        resource["ory.git.branch"] = opts.gitBranch;
+    if (opts.gitCommit)
+        resource["ory.git.commit"] = opts.gitCommit;
+    for (const [k, v] of Object.entries(parseKeyValueList(env.OTEL_RESOURCE_ATTRIBUTES))) {
+        resource[k] = v;
+    }
+    return new OtlpHttpExporter({
+        endpoint,
+        headers,
+        resource,
+        onError: opts.onError,
+    });
+}
+// ─── Endpoint / header parsing ─────────────────────────────────────
+function resolveEndpoint(env) {
+    const tracesUrl = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+    if (tracesUrl) {
+        // User specified the full traces URL — use as-is.
+        return tracesUrl;
+    }
+    // ORY_OTLP_ENDPOINT is an ORY-prefixed alias used by the dev launcher.
+    // Some harnesses (e.g. Claude Code) filter the env they pass to hook
+    // subprocesses and drop OTEL_*-prefixed vars, but allow ORY_*-prefixed
+    // ones through. The alias lets the launcher hand the OTLP endpoint to
+    // the hook process without depending on OTEL_* propagation.
+    const base = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || env.ORY_OTLP_ENDPOINT?.trim();
+    if (!base)
+        return undefined;
+    return base.replace(/\/+$/, "") + TRACES_PATH;
+}
+/**
+ * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
+ */
+function parseKeyValueList(raw) {
+    const out = {};
+    if (!raw)
+        return out;
+    for (const pair of raw.split(",")) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        const value = trimmed.slice(eq + 1).trim();
+        if (!key)
+            continue;
+        out[key] = safeDecodeURIComponent(value);
+    }
+    return out;
+}
+function safeDecodeURIComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function mergeHeaders(...sources) {
+    const out = {};
+    for (const src of sources) {
+        for (const [k, v] of Object.entries(src)) {
+            out[k.toLowerCase()] = v;
+        }
+    }
+    return out;
+}
+function buildExportRequest(spans, resource) {
+    const otlpSpans = spans.map(toOtlpSpan);
+    return {
+        resourceSpans: [
+            {
+                resource: { attributes: toAttributes(resource) },
+                scopeSpans: [
+                    {
+                        scope: { name: SCOPE_NAME },
+                        spans: otlpSpans,
+                    },
+                ],
+            },
+        ],
+    };
+}
+function toOtlpSpan(span) {
+    // OTLP/HTTP JSON expects 32-hex traceId and 16-hex spanId per the
+    // proto3-JSON canonical mapping with hex string encoding (the OTel
+    // spec also allows base64; modern collectors and Honeycomb accept
+    // hex). Pad short ids with leading zeros.
+    const status = toOtlpStatus(span.status);
+    const baseAttributes = {
+        "ory.event": span.event,
+        "ory.span.status": span.status,
+        "ory.duration_ms": span.durationMs,
+    };
+    if (span.sessionId)
+        baseAttributes["ory.session_id"] = span.sessionId;
+    const flat = flattenAttributes(span.attributes ?? {});
+    const attrs = { ...baseAttributes, ...flat };
+    return {
+        traceId: padHex(span.traceId, 32),
+        spanId: padHex(span.spanId, 16),
+        ...(span.parentSpanId
+            ? { parentSpanId: padHex(span.parentSpanId, 16) }
+            : {}),
+        name: span.event,
+        kind: 1, // SPAN_KIND_INTERNAL
+        startTimeUnixNano: isoToUnixNano(span.startedAt),
+        endTimeUnixNano: isoToUnixNano(span.endedAt),
+        attributes: toAttributes(attrs),
+        ...(status ? { status } : {}),
+    };
+}
+function toOtlpStatus(status) {
+    switch (status) {
+        case "ok":
+            return { code: 1 };
+        case "error":
+            return { code: 2, message: "error" };
+        case "denied":
+            return { code: 2, message: "denied" };
+        case "skipped":
+            return undefined; // STATUS_CODE_UNSET
+        default:
+            return undefined;
+    }
+}
+function isoToUnixNano(iso) {
+    const ms = Date.parse(iso);
+    if (!Number.isFinite(ms))
+        return "0";
+    // BigInt avoids 2^53 rounding for ns timestamps.
+    return (BigInt(ms) * 1000000n).toString();
+}
+function padHex(hex, length) {
+    const lower = hex.toLowerCase().replace(/[^0-9a-f]/g, "");
+    if (lower.length >= length)
+        return lower.slice(-length);
+    return lower.padStart(length, "0");
+}
+function toAttributes(source) {
+    const out = [];
+    for (const [key, value] of Object.entries(source)) {
+        const v = toAnyValue(value);
+        if (v)
+            out.push({ key, value: v });
+    }
+    return out;
+}
+function toAnyValue(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === "string")
+        return { stringValue: value };
+    if (typeof value === "boolean")
+        return { boolValue: value };
+    if (typeof value === "number") {
+        if (Number.isInteger(value)) {
+            return { intValue: value.toString() };
+        }
+        return { doubleValue: value };
+    }
+    return undefined;
+}
+/**
+ * Flatten nested attribute objects into a single-level Record where
+ * complex values are JSON-stringified. Keeps OTLP attributes compact
+ * and queryable as scalars in vendor backends.
+ */
+function flattenAttributes(attrs) {
+    const out = {};
+    for (const [key, value] of Object.entries(attrs)) {
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value === "string" ||
+            typeof value === "number" ||
+            typeof value === "boolean") {
+            out[key] = value;
+        }
+        else {
+            try {
+                out[key] = JSON.stringify(value);
+            }
+            catch {
+                /* skip un-serializable values */
+            }
+        }
+    }
+    return out;
+}

package/dist/registry/cli.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI interface for the `registry` subcommand.
+ *
+ * Manages the local npm registry lifecycle.
+ */
+/**
+ * Run a `registry` subcommand.
+ *
+ * @param binName - The CLI name for help text
+ * @param args - Arguments after "registry"
+ */
+export declare function runRegistryCommand(binName: string, args: string[]): Promise<void>;

package/dist/registry/cli.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * CLI interface for the `registry` subcommand.
+ *
+ * Manages the local npm registry lifecycle.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRegistryCommand = runRegistryCommand;
+const manager_js_1 = require("./manager.js");
+/**
+ * Run a `registry` subcommand.
+ *
+ * @param binName - The CLI name for help text
+ * @param args - Arguments after "registry"
+ */
+async function runRegistryCommand(binName, args) {
+    const [subcommand] = args;
+    switch (subcommand) {
+        case "start":
+            await (0, manager_js_1.registryStart)();
+            break;
+        case "stop":
+            await (0, manager_js_1.registryStop)();
+            break;
+        case "status":
+            await (0, manager_js_1.registryStatus)();
+            break;
+        case "publish":
+            await (0, manager_js_1.registryPublish)();
+            break;
+        case "clean":
+            await (0, manager_js_1.registryClean)();
+            break;
+        case "npmrc":
+            (0, manager_js_1.registryNpmrc)();
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            printRegistryHelp(binName);
+            break;
+        default:
+            console.error(`Unknown registry subcommand: ${subcommand}`);
+            printRegistryHelp(binName);
+            process.exit(1);
+    }
+}
+function printRegistryHelp(binName) {
+    console.log(`
+${binName} registry — Local npm registry for development
+
+Usage:
+  ${binName} registry <command>
+
+Commands:
+  start       Start the local Verdaccio npm registry (Docker container)
+  stop        Stop the running registry
+  status      Show registry status and published packages
+  publish     Build and publish all workspace packages to the local registry
+  clean       Stop the registry and remove all data
+  npmrc       Print registry URL for use in .npmrc or --registry flag
+
+The local registry runs Verdaccio in a Docker container (ory-registry)
+on http://localhost:4873. Storage and config live under .ory-dev/registry/
+on the host, bind-mounted into the container. Everything is ephemeral —
+'clean' removes both the container and the on-disk data.
+
+Workflow:
+  ${binName} registry start          # Start the registry
+  ${binName} registry publish        # Build and publish all packages
+  npm install --registry http://localhost:4873 @ory/claude-code
+  ${binName} registry stop           # Stop when done
+  ${binName} registry clean          # Remove all data
+`);
+}

package/dist/registry/config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Verdaccio configuration generator.
+ *
+ * Generates a config file used by the local Verdaccio Docker container.
+ * Paths inside the YAML refer to container-internal locations: the
+ * registry manager bind-mounts the host's `.ory-dev/registry/storage`
+ * directory at `/verdaccio/storage` and the rendered config at
+ * `/verdaccio/conf/config.yaml`. Logs go to stdout so `docker logs`
+ * surfaces them without needing a writable log volume.
+ */
+export declare const REGISTRY_PORT = 4873;
+export declare const REGISTRY_URL = "http://localhost:4873";
+export declare const REGISTRY_DIR_NAME = ".ory-dev/registry";
+/** Docker image used to run Verdaccio. Pinned to v6 to match prior CLI usage. */
+export declare const REGISTRY_IMAGE = "verdaccio/verdaccio:6";
+/** Container name for the local registry. Distinct from any user-managed Verdaccio. */
+export declare const REGISTRY_CONTAINER = "ory-registry";
+/** Container-internal path where the manager mounts the host storage directory. */
+export declare const REGISTRY_CONTAINER_STORAGE = "/verdaccio/storage";
+/** Container-internal path where the manager mounts the rendered config file. */
+export declare const REGISTRY_CONTAINER_CONFIG = "/verdaccio/conf/config.yaml";
+export declare function verdaccioConfigYaml(): string;
+export declare function npmrcContent(): string;

package/dist/registry/config.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Verdaccio configuration generator.
+ *
+ * Generates a config file used by the local Verdaccio Docker container.
+ * Paths inside the YAML refer to container-internal locations: the
+ * registry manager bind-mounts the host's `.ory-dev/registry/storage`
+ * directory at `/verdaccio/storage` and the rendered config at
+ * `/verdaccio/conf/config.yaml`. Logs go to stdout so `docker logs`
+ * surfaces them without needing a writable log volume.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY_CONTAINER_CONFIG = exports.REGISTRY_CONTAINER_STORAGE = exports.REGISTRY_CONTAINER = exports.REGISTRY_IMAGE = exports.REGISTRY_DIR_NAME = exports.REGISTRY_URL = exports.REGISTRY_PORT = void 0;
+exports.verdaccioConfigYaml = verdaccioConfigYaml;
+exports.npmrcContent = npmrcContent;
+exports.REGISTRY_PORT = 4873;
+exports.REGISTRY_URL = `http://localhost:${exports.REGISTRY_PORT}`;
+exports.REGISTRY_DIR_NAME = ".ory-dev/registry";
+/** Docker image used to run Verdaccio. Pinned to v6 to match prior CLI usage. */
+exports.REGISTRY_IMAGE = "verdaccio/verdaccio:6";
+/** Container name for the local registry. Distinct from any user-managed Verdaccio. */
+exports.REGISTRY_CONTAINER = "ory-registry";
+/** Container-internal path where the manager mounts the host storage directory. */
+exports.REGISTRY_CONTAINER_STORAGE = "/verdaccio/storage";
+/** Container-internal path where the manager mounts the rendered config file. */
+exports.REGISTRY_CONTAINER_CONFIG = "/verdaccio/conf/config.yaml";
+function verdaccioConfigYaml() {
+    return `# Auto-generated Verdaccio config for local development.
+# Do not edit — regenerated on each 'registry start'.
+
+storage: ${exports.REGISTRY_CONTAINER_STORAGE}
+
+auth:
+  htpasswd:
+    file: ${exports.REGISTRY_CONTAINER_STORAGE}/htpasswd
+    # max_users intentionally omitted. Setting any finite value here (even
+    # generous ones like 100) causes Verdaccio 6 to short-circuit our dev
+    # user's first PUT with 409 "username already registered" before the
+    # htpasswd plugin can create it. Defaults to +Inf, which works.
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+    cache: false
+
+packages:
+  "@ory/*":
+    access: $all
+    publish: $all
+    unpublish: $all
+    # Locally-published workspace packages (e.g. @ory/argus) are served from
+    # storage; everything else under @ory/* (notably @ory/client, a transitive
+    # dep) falls through to npmjs. Without this, transitive @ory/client
+    # resolution fails with E404 against the local registry.
+    proxy: npmjs
+
+  "**":
+    access: $all
+    publish: $all
+    proxy: npmjs
+
+server:
+  keepAliveTimeout: 60
+
+middlewares:
+  audit:
+    enabled: true
+
+# Stream logs to stdout so 'docker logs ${exports.REGISTRY_CONTAINER}' surfaces them.
+log:
+  type: stdout
+  format: pretty
+  level: warn
+`;
+}
+function npmrcContent() {
+    return `registry=${exports.REGISTRY_URL}/
+//localhost:${exports.REGISTRY_PORT}/:_authToken=local-dev-token
+`;
+}

package/dist/registry/index.d.ts

@@ -0,0 +1,3 @@
+export { runRegistryCommand } from "./cli.js";
+export { registryStart, registryStop, registryStatus, registryPublish, registryClean, registryNpmrc, ensureRegistryRunning, publishHarnessToLocal, getLocalRegistryNpmCacheDir, } from "./manager.js";
+export { REGISTRY_PORT, REGISTRY_URL, REGISTRY_DIR_NAME, REGISTRY_IMAGE, REGISTRY_CONTAINER, } from "./config.js";

package/dist/registry/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY_CONTAINER = exports.REGISTRY_IMAGE = exports.REGISTRY_DIR_NAME = exports.REGISTRY_URL = exports.REGISTRY_PORT = exports.getLocalRegistryNpmCacheDir = exports.publishHarnessToLocal = exports.ensureRegistryRunning = exports.registryNpmrc = exports.registryClean = exports.registryPublish = exports.registryStatus = exports.registryStop = exports.registryStart = exports.runRegistryCommand = void 0;
+var cli_js_1 = require("./cli.js");
+Object.defineProperty(exports, "runRegistryCommand", { enumerable: true, get: function () { return cli_js_1.runRegistryCommand; } });
+var manager_js_1 = require("./manager.js");
+Object.defineProperty(exports, "registryStart", { enumerable: true, get: function () { return manager_js_1.registryStart; } });
+Object.defineProperty(exports, "registryStop", { enumerable: true, get: function () { return manager_js_1.registryStop; } });
+Object.defineProperty(exports, "registryStatus", { enumerable: true, get: function () { return manager_js_1.registryStatus; } });
+Object.defineProperty(exports, "registryPublish", { enumerable: true, get: function () { return manager_js_1.registryPublish; } });
+Object.defineProperty(exports, "registryClean", { enumerable: true, get: function () { return manager_js_1.registryClean; } });
+Object.defineProperty(exports, "registryNpmrc", { enumerable: true, get: function () { return manager_js_1.registryNpmrc; } });
+Object.defineProperty(exports, "ensureRegistryRunning", { enumerable: true, get: function () { return manager_js_1.ensureRegistryRunning; } });
+Object.defineProperty(exports, "publishHarnessToLocal", { enumerable: true, get: function () { return manager_js_1.publishHarnessToLocal; } });
+Object.defineProperty(exports, "getLocalRegistryNpmCacheDir", { enumerable: true, get: function () { return manager_js_1.getLocalRegistryNpmCacheDir; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "REGISTRY_PORT", { enumerable: true, get: function () { return config_js_1.REGISTRY_PORT; } });
+Object.defineProperty(exports, "REGISTRY_URL", { enumerable: true, get: function () { return config_js_1.REGISTRY_URL; } });
+Object.defineProperty(exports, "REGISTRY_DIR_NAME", { enumerable: true, get: function () { return config_js_1.REGISTRY_DIR_NAME; } });
+Object.defineProperty(exports, "REGISTRY_IMAGE", { enumerable: true, get: function () { return config_js_1.REGISTRY_IMAGE; } });
+Object.defineProperty(exports, "REGISTRY_CONTAINER", { enumerable: true, get: function () { return config_js_1.REGISTRY_CONTAINER; } });