@ory/argus 0.1.0

package/dist/registry/manager.js

@@ -0,0 +1,674 @@
+"use strict";
+/**
+ * Local npm registry manager.
+ *
+ * Manages a Verdaccio Docker container for publishing and installing
+ * @ory packages locally. Completely ephemeral — the
+ * container is started with `--rm` and all state lives under
+ * `.ory-dev/registry/` on the host, bind-mounted into the container.
+ *
+ * Mirrors the lifecycle model used by the standalone Jaeger container
+ * (see `local/jaeger.ts`): single `docker run -d --rm --name <name>`,
+ * idempotent start, removal via `docker rm -f`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLocalRegistryNpmCacheDir = getLocalRegistryNpmCacheDir;
+exports.ensureRegistryRunning = ensureRegistryRunning;
+exports.publishHarnessToLocal = publishHarnessToLocal;
+exports.registryStart = registryStart;
+exports.registryStop = registryStop;
+exports.registryStatus = registryStatus;
+exports.registryPublish = registryPublish;
+exports.registryClean = registryClean;
+exports.registryNpmrc = registryNpmrc;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const config_js_1 = require("./config.js");
+function findProjectRoot(startDir) {
+    let dir = startDir;
+    while (dir !== path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, "pnpm-workspace.yaml")) ||
+            fs.existsSync(path.join(dir, ".git"))) {
+            return dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return startDir;
+}
+function getRegistryDir() {
+    const root = findProjectRoot(process.cwd());
+    return path.join(root, config_js_1.REGISTRY_DIR_NAME);
+}
+/**
+ * Per-registry npm cache directory.
+ *
+ * Isolating npm's pacote cache here is the only way to keep republishing
+ * the same version reliably — npm caches manifests by URL, so the user's
+ * `~/.npm` would otherwise serve stale "this version exists" answers to
+ * pnpm publish/npm install even after we drop the version from Verdaccio.
+ */
+function getLocalRegistryNpmCacheDir() {
+    return path.join(getRegistryDir(), "npm-cache");
+}
+function ensureDir(dir) {
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+function listWorkspaceScopedPackages(workspaceRoot) {
+    return listWorkspaceScopedPackageJsons(workspaceRoot)
+        .map((file) => readPackageName(file))
+        .filter((n) => n !== null);
+}
+function listWorkspaceScopedPackageJsons(workspaceRoot) {
+    const packagesDir = path.join(workspaceRoot, "packages");
+    if (!fs.existsSync(packagesDir))
+        return [];
+    const files = [];
+    for (const entry of fs.readdirSync(packagesDir)) {
+        const pkgJson = path.join(packagesDir, entry, "package.json");
+        if (!fs.existsSync(pkgJson))
+            continue;
+        if (readPackageName(pkgJson)?.startsWith("@ory/")) {
+            files.push(pkgJson);
+        }
+    }
+    return files;
+}
+function readPackageName(pkgJsonPath) {
+    try {
+        const data = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+        return data.name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Strip `publishConfig.registry` and `publishConfig.provenance` from every
+ * `@ory/*` package.json for the duration of `fn`, then restore.
+ *
+ * The OIDC trusted-publishing release workflow pins each package's
+ * `publishConfig.registry` to `https://registry.npmjs.org/` with
+ * `provenance: true`. `publishConfig` overrides both the `--registry` CLI
+ * flag and the `npm_config_registry` env var on `pnpm publish`, so without
+ * this transform `pnpm publish --registry http://localhost:4873` still
+ * targets real npmjs.org and fails with `E404 undefined` (no auth) /
+ * provenance errors. We unset the two fields only on disk for the publish
+ * call, then put the files back exactly as they were so the CI release
+ * workflow keeps working.
+ */
+async function withLocalPublishConfig(workspaceRoot, fn) {
+    const files = listWorkspaceScopedPackageJsons(workspaceRoot);
+    const backups = new Map();
+    for (const file of files) {
+        const original = fs.readFileSync(file, "utf-8");
+        const pkg = JSON.parse(original);
+        if (!pkg.publishConfig)
+            continue;
+        const stripped = { ...pkg.publishConfig };
+        delete stripped.registry;
+        delete stripped.provenance;
+        backups.set(file, original);
+        const next = { ...pkg, publishConfig: stripped };
+        fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
+    }
+    const restore = () => {
+        for (const [file, original] of backups) {
+            try {
+                fs.writeFileSync(file, original);
+            }
+            catch {
+                // Best-effort on shutdown paths.
+            }
+        }
+        backups.clear();
+    };
+    const sigHandler = () => {
+        restore();
+        process.exit(130);
+    };
+    process.once("SIGINT", sigHandler);
+    process.once("SIGTERM", sigHandler);
+    try {
+        return await fn();
+    }
+    finally {
+        process.off("SIGINT", sigHandler);
+        process.off("SIGTERM", sigHandler);
+        restore();
+    }
+}
+async function cleanScopeStorage() {
+    // Verdaccio caches package metadata in memory; deleting on-disk storage
+    // alone leaves stale manifests served and causes publish to report
+    // "already exists". Issue an HTTP DELETE for every known scoped package
+    // first (Verdaccio drops both memory + disk state), then remove any
+    // residual scope dir for completeness.
+    const root = findProjectRoot(process.cwd());
+    const names = listWorkspaceScopedPackages(root);
+    await Promise.all(names.map(async (name) => {
+        const encoded = name.replace("/", "%2f");
+        try {
+            await fetch(`${config_js_1.REGISTRY_URL}/${encoded}/-rev/0`, { method: "DELETE" });
+        }
+        catch {
+            // Best-effort.
+        }
+    }));
+    const scopeDir = path.join(getRegistryDir(), "storage", "@ory");
+    if (fs.existsSync(scopeDir)) {
+        fs.rmSync(scopeDir, { recursive: true, force: true });
+    }
+}
+// ─── Docker plumbing ───────────────────────────────────────────────
+function dockerAvailable() {
+    const result = (0, node_child_process_1.spawnSync)("docker", ["info"], { stdio: "ignore" });
+    return result.status === 0;
+}
+function inspectContainer(name) {
+    const result = (0, node_child_process_1.spawnSync)("docker", ["inspect", "--format", "{{.State.Running}}", name], { stdio: ["ignore", "pipe", "ignore"] });
+    if (result.status !== 0) {
+        return { exists: false, running: false };
+    }
+    const out = (result.stdout?.toString() ?? "").trim();
+    return { exists: true, running: out === "true" };
+}
+/**
+ * Build the `--user UID:GID` args matching the host user, so bind-mounted
+ * files written by Verdaccio are owned by the host user (otherwise
+ * `cleanScopeStorage`'s `fs.rmSync` would fail on Linux). No-op on
+ * Windows where the POSIX uid/gid accessors return undefined.
+ */
+function hostUserArgs() {
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    const gid = typeof process.getgid === "function" ? process.getgid() : undefined;
+    if (uid === undefined || gid === undefined)
+        return [];
+    return ["--user", `${uid}:${gid}`];
+}
+function isRegistryRunning() {
+    return inspectContainer(config_js_1.REGISTRY_CONTAINER).running;
+}
+// ─── Token storage ─────────────────────────────────────────────────
+function getTokenFile(registryDir) {
+    return path.join(registryDir, "auth-token");
+}
+function readToken(registryDir) {
+    const tokenFile = getTokenFile(registryDir);
+    if (!fs.existsSync(tokenFile))
+        return null;
+    return fs.readFileSync(tokenFile, "utf-8").trim() || null;
+}
+async function waitForRegistry(timeoutMs = 30_000) {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+        try {
+            const res = await fetch(`${config_js_1.REGISTRY_URL}/-/ping`);
+            if (res.ok)
+                return true;
+        }
+        catch {
+            // Not ready yet
+        }
+        await new Promise((r) => setTimeout(r, 250));
+    }
+    return false;
+}
+/**
+ * Register a dev user with Verdaccio and return the auth token.
+ *
+ * Verdaccio 6 requires the full CouchDB-style user document — a minimal
+ * `{name, password}` body short-circuits with 409 before the auth plugin
+ * can create the user. If the user already exists (rare, only when
+ * htpasswd state leaked from a prior run), retry as a login.
+ */
+async function registerDevUser(registryDir) {
+    const headers = { "Content-Type": "application/json" };
+    const userPath = "/-/user/org.couchdb.user:dev";
+    const createPayload = JSON.stringify({
+        _id: "org.couchdb.user:dev",
+        name: "dev",
+        password: "dev",
+        type: "user",
+        roles: [],
+        date: new Date().toISOString(),
+    });
+    let res = await fetch(`${config_js_1.REGISTRY_URL}${userPath}`, {
+        method: "PUT",
+        headers,
+        body: createPayload,
+    });
+    if (res.status === 409) {
+        res = await fetch(`${config_js_1.REGISTRY_URL}${userPath}`, {
+            method: "PUT",
+            headers,
+            body: JSON.stringify({ name: "dev", password: "dev" }),
+        });
+    }
+    // 201 = created, 200 = logged in
+    if (!res.ok) {
+        throw new Error(`Failed to register dev user: HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    const token = body.token;
+    if (!token) {
+        throw new Error("Verdaccio did not return an auth token.");
+    }
+    fs.writeFileSync(getTokenFile(registryDir), token);
+    return token;
+}
+// ─── Public lifecycle ──────────────────────────────────────────────
+/**
+ * Start the local registry if it isn't already running.
+ */
+async function ensureRegistryRunning() {
+    if (isRegistryRunning())
+        return;
+    await registryStart();
+}
+/**
+ * Env vars stripped before invoking the per-package publish, mirroring the
+ * defensive `env -u` list in the root `publish-packages` script that the
+ * release workflow runs. Keeping the two lists identical means a local
+ * publish sees the same minimal npm config the CI publish does, instead of
+ * silently inheriting whatever the developer has set globally.
+ */
+const STRIPPED_NPM_CONFIG_ENV = [
+    "npm_config_globalconfig",
+    "npm_config_npm_globalconfig",
+    "npm_config_dir",
+    "npm_config_workspace_root",
+    "npm_config_verify_deps_before_run",
+    "npm_config_minimum_release_age",
+    "npm_config__jsr_registry",
+];
+function publishEnv(extra) {
+    const env = { ...process.env };
+    for (const key of STRIPPED_NPM_CONFIG_ENV) {
+        delete env[key];
+    }
+    return { ...env, ...extra };
+}
+/**
+ * Publish all `@ory/*` workspace packages to the local registry.
+ *
+ * Intent: mirror the production release path (`pnpm publish-packages` →
+ * `changeset publish`) as closely as a local Verdaccio target allows. The
+ * release workflow runs `pnpm build` first and strips a fixed set of npm
+ * config env vars; we do the same here. The remaining divergences are
+ * forced by the local target:
+ *
+ *   - `publishConfig.registry`/`provenance` is stripped from each
+ *     package.json for the duration of the call so writes land on
+ *     localhost instead of npmjs.org. See `withLocalPublishConfig`.
+ *   - Auth is a Verdaccio `_authToken` rather than OIDC trusted
+ *     publishing.
+ *   - The publish primitive is a two-step `pnpm pack` + `npm publish
+ *     <tarball>`, rather than the single `pnpm publish` prod uses. Neither
+ *     tool alone covers both required behaviors against Verdaccio:
+ *       * `pnpm publish` rewrites `workspace:*` dep specifiers to a
+ *         concrete version when packing (npm publish does not — it would
+ *         upload `workspace:*` literally and the sandbox install would
+ *         then fail with `Unsupported URL Type "workspace:"`).
+ *       * `npm publish` populates the `readme` field in the manifest
+ *         payload (pnpm publish does not — npmjs.org extracts README
+ *         server-side from the tarball, but Verdaccio doesn't, so its UI
+ *         shows "No README data found!").
+ *     `pnpm pack` does the workspace rewrite while producing a tarball;
+ *     `npm publish` of that tarball populates the readme field.
+ *   - We force a republish at the same version (Verdaccio scope is wiped
+ *     first); changeset's "skip if already published" check is bypassed.
+ *
+ * @param opts.quiet  Suppress per-package output and only surface the
+ *                    captured streams on failure. Used by the dev
+ *                    launcher to keep its console clean.
+ */
+async function publishAllOryToLocal(opts = {}) {
+    if (!isRegistryRunning()) {
+        throw new Error("Local registry is not running. Call ensureRegistryRunning() first.");
+    }
+    const registryDir = getRegistryDir();
+    const token = readToken(registryDir);
+    if (!token) {
+        throw new Error("No registry auth token found. Restart the registry: pnpm registry:clean && pnpm registry:start");
+    }
+    await cleanScopeStorage();
+    const cacheDir = getLocalRegistryNpmCacheDir();
+    if (fs.existsSync(cacheDir)) {
+        fs.rmSync(cacheDir, { recursive: true, force: true });
+    }
+    const packDir = path.join(registryDir, "pack");
+    if (fs.existsSync(packDir)) {
+        fs.rmSync(packDir, { recursive: true, force: true });
+    }
+    fs.mkdirSync(packDir, { recursive: true });
+    const root = findProjectRoot(process.cwd());
+    const pkgJsons = listWorkspaceScopedPackageJsons(root);
+    await withLocalPublishConfig(root, () => {
+        for (const pkgJsonPath of pkgJsons) {
+            const pkgDir = path.dirname(pkgJsonPath);
+            const { name, version } = readPackageNameVersion(pkgJsonPath);
+            const pkgName = name ?? path.basename(pkgDir);
+            if (!opts.quiet) {
+                console.log(`Publishing ${pkgName}...`);
+            }
+            const packResult = (0, node_child_process_1.spawnSync)("pnpm", ["pack", "--pack-destination", packDir], {
+                cwd: pkgDir,
+                stdio: opts.quiet ? "pipe" : "inherit",
+                encoding: "utf-8",
+                env: publishEnv({}),
+            });
+            if (packResult.status !== 0) {
+                emitCapturedOutput(opts.quiet, "pnpm pack", packResult);
+                throw new Error(`Failed to pack ${pkgName} for local registry (exit ${packResult.status}).`);
+            }
+            const tarball = path.join(packDir, tarballFilename(pkgName, version));
+            if (!fs.existsSync(tarball)) {
+                throw new Error(`Packed ${pkgName} but expected tarball not found at ${tarball}.`);
+            }
+            const publishResult = (0, node_child_process_1.spawnSync)("npm", ["publish", tarball, "--registry", config_js_1.REGISTRY_URL, "--access=public"], {
+                cwd: pkgDir,
+                stdio: opts.quiet ? "pipe" : "inherit",
+                encoding: "utf-8",
+                env: publishEnv({
+                    npm_config_registry: config_js_1.REGISTRY_URL,
+                    npm_config_cache: cacheDir,
+                    npm_config_loglevel: "error",
+                    // Per-registry auth token. Verdaccio's `publish: $all` allows
+                    // anonymous writes, but npm itself refuses to publish without
+                    // local credentials.
+                    [`npm_config_//${stripScheme(config_js_1.REGISTRY_URL)}/:_authToken`]: token,
+                }),
+            });
+            if (publishResult.status !== 0) {
+                emitCapturedOutput(opts.quiet, "npm publish", publishResult);
+                throw new Error(`Failed to publish ${pkgName} to local registry (exit ${publishResult.status}).`);
+            }
+        }
+    });
+}
+function readPackageNameVersion(pkgJsonPath) {
+    try {
+        const data = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+        return { name: data.name ?? null, version: data.version ?? "0.0.0" };
+    }
+    catch {
+        return { name: null, version: "0.0.0" };
+    }
+}
+function tarballFilename(pkgName, version) {
+    return `${pkgName.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
+}
+function emitCapturedOutput(quiet, label, result) {
+    if (!quiet)
+        return;
+    const stdout = (result.stdout ?? "").toString().trim();
+    const stderr = (result.stderr ?? "").toString().trim();
+    if (!stdout && !stderr)
+        return;
+    process.stderr.write(`\n── ${label} output ──\n`);
+    if (stdout)
+        process.stderr.write(stdout + "\n");
+    if (stderr)
+        process.stderr.write(stderr + "\n");
+    process.stderr.write(`── end ${label} output ──\n\n`);
+}
+function stripScheme(url) {
+    return url.replace(/^https?:\/\//, "");
+}
+/**
+ * Publish all `@ory/*` packages to the local registry — entrypoint used by
+ * the dev launcher. The `harnessName` arg is retained for call-site
+ * compatibility; we publish the whole scope every time so any harness gets
+ * a coherent registry state without needing to compute its dep closure.
+ */
+async function publishHarnessToLocal(_harnessName) {
+    await publishAllOryToLocal({ quiet: true });
+}
+// ─── Commands ──────────────────────────────────────────────────────
+async function registryStart() {
+    const registryDir = getRegistryDir();
+    const storageDir = path.join(registryDir, "storage");
+    if (isRegistryRunning()) {
+        console.log(`Local registry is already running (container ${config_js_1.REGISTRY_CONTAINER}).`);
+        console.log(`  URL: ${config_js_1.REGISTRY_URL}`);
+        return;
+    }
+    if (!dockerAvailable()) {
+        console.error("Error: Docker is not running. Start Docker Desktop (or the Docker daemon) and try again.");
+        process.exit(1);
+    }
+    console.log("Starting local npm registry (Verdaccio in Docker)...");
+    console.log(`  Image:     ${config_js_1.REGISTRY_IMAGE}`);
+    console.log(`  Container: ${config_js_1.REGISTRY_CONTAINER}`);
+    console.log(`  Directory: ${registryDir}`);
+    console.log(`  URL:       ${config_js_1.REGISTRY_URL}`);
+    console.log("");
+    // Write config files on the host. Both are bind-mounted into the container.
+    ensureDir(registryDir);
+    ensureDir(storageDir);
+    // Wipe the persisted htpasswd + Verdaccio metadata DB on every fresh start.
+    // Without this, a stale `dev` entry from a previous run causes the new
+    // container's user registration to short-circuit with 409 ("user already
+    // exists") before reaching the htpasswd auth plugin, which then never
+    // hands back a usable token. The registry is ephemeral by design (clean
+    // wipes everything anyway), so dropping the htpasswd here is safe.
+    for (const stale of ["htpasswd", ".verdaccio-db.json"]) {
+        const p = path.join(storageDir, stale);
+        if (fs.existsSync(p))
+            fs.rmSync(p, { force: true });
+    }
+    const configPath = path.join(registryDir, "config.yaml");
+    fs.writeFileSync(configPath, (0, config_js_1.verdaccioConfigYaml)());
+    // .npmrc is consumed by host-side npm/pnpm tooling, not by the container.
+    fs.writeFileSync(path.join(registryDir, ".npmrc"), (0, config_js_1.npmrcContent)());
+    // Stale --rm container could only exist if Docker died mid-run; clean it up
+    // so the new `docker run --rm` doesn't collide on the container name.
+    const state = inspectContainer(config_js_1.REGISTRY_CONTAINER);
+    if (state.exists && !state.running) {
+        (0, node_child_process_1.spawnSync)("docker", ["rm", "-f", config_js_1.REGISTRY_CONTAINER], { stdio: "ignore" });
+    }
+    const runArgs = [
+        "run",
+        "-d",
+        "--rm",
+        "--name",
+        config_js_1.REGISTRY_CONTAINER,
+        "-p",
+        `${config_js_1.REGISTRY_PORT}:${config_js_1.REGISTRY_PORT}`,
+        ...hostUserArgs(),
+        "-v",
+        `${storageDir}:${config_js_1.REGISTRY_CONTAINER_STORAGE}`,
+        "-v",
+        `${configPath}:${config_js_1.REGISTRY_CONTAINER_CONFIG}:ro`,
+        config_js_1.REGISTRY_IMAGE,
+    ];
+    const run = (0, node_child_process_1.spawnSync)("docker", runArgs, {
+        stdio: ["ignore", "ignore", "pipe"],
+        encoding: "utf-8",
+    });
+    if (run.status !== 0) {
+        const stderr = (run.stderr ?? "").toString().trim();
+        console.error(`Error: 'docker run ${config_js_1.REGISTRY_IMAGE}' failed (exit ${run.status}).`);
+        if (stderr)
+            console.error(stderr);
+        process.exit(1);
+    }
+    // Wait for it to become ready (Verdaccio startup + image pull on first run
+    // can take longer than a native process — bump the default timeout).
+    console.log("  Waiting for registry to become ready...");
+    const ready = await waitForRegistry();
+    if (!ready) {
+        console.error("Error: Registry did not start within 30 seconds.");
+        console.error(`  Inspect container logs: docker logs ${config_js_1.REGISTRY_CONTAINER}`);
+        process.exit(1);
+    }
+    // Register a dev user for publish auth
+    console.log("  Registering dev user for publish access...");
+    try {
+        await registerDevUser(registryDir);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`  Warning: Could not register dev user: ${msg}`);
+        console.error("  Publishing may fail. You can retry with 'registry:start'.");
+    }
+    console.log(`  Registry is running (container ${config_js_1.REGISTRY_CONTAINER}).`);
+    console.log("");
+    console.log("To publish all packages:");
+    console.log("  pnpm registry:publish");
+    console.log("");
+    console.log("To install from this registry:");
+    console.log(`  npm install --registry ${config_js_1.REGISTRY_URL} @ory/<package>`);
+}
+async function registryStop() {
+    if (!dockerAvailable()) {
+        console.log("Local registry is not running (Docker is unavailable, so no container could be active).");
+        return;
+    }
+    const state = inspectContainer(config_js_1.REGISTRY_CONTAINER);
+    if (!state.exists) {
+        console.log("Local registry is not running.");
+        return;
+    }
+    console.log(`Stopping local registry (container ${config_js_1.REGISTRY_CONTAINER})...`);
+    const rm = (0, node_child_process_1.spawnSync)("docker", ["rm", "-f", config_js_1.REGISTRY_CONTAINER], {
+        stdio: ["ignore", "ignore", "pipe"],
+        encoding: "utf-8",
+    });
+    if (rm.status !== 0) {
+        const stderr = (rm.stderr ?? "").toString().trim();
+        console.error(`Warning: 'docker rm -f' exited ${rm.status}.`);
+        if (stderr)
+            console.error(stderr);
+        return;
+    }
+    console.log("Registry stopped.");
+}
+async function registryStatus() {
+    const registryDir = getRegistryDir();
+    console.log("Local npm Registry Status");
+    console.log("=========================");
+    console.log("");
+    console.log(`  Directory: ${registryDir}`);
+    console.log(`  URL:       ${config_js_1.REGISTRY_URL}`);
+    console.log(`  Container: ${config_js_1.REGISTRY_CONTAINER} (${config_js_1.REGISTRY_IMAGE})`);
+    console.log("");
+    if (!dockerAvailable()) {
+        console.log("  Status: UNKNOWN (Docker is not running)");
+        console.log("  Start Docker Desktop and re-run 'registry:status'.");
+        return;
+    }
+    if (!fs.existsSync(registryDir)) {
+        console.log("  Status: NOT INITIALIZED");
+        console.log("  Run 'registry:start' to start the local registry.");
+        return;
+    }
+    const state = inspectContainer(config_js_1.REGISTRY_CONTAINER);
+    if (!state.exists || !state.running) {
+        console.log("  Status: STOPPED");
+        console.log("  Run 'registry:start' to start the local registry.");
+        return;
+    }
+    console.log(`  Status: RUNNING`);
+    // Check if it responds to pings
+    try {
+        const res = await fetch(`${config_js_1.REGISTRY_URL}/-/ping`);
+        if (res.ok) {
+            console.log("  Health: OK");
+        }
+        else {
+            console.log(`  Health: UNHEALTHY (HTTP ${res.status})`);
+        }
+    }
+    catch {
+        console.log("  Health: UNREACHABLE");
+    }
+    // List published packages
+    const storageDir = path.join(registryDir, "storage");
+    if (fs.existsSync(storageDir)) {
+        const scopeDir = path.join(storageDir, "@ory");
+        if (fs.existsSync(scopeDir)) {
+            const packages = fs.readdirSync(scopeDir).filter((f) => {
+                return fs.statSync(path.join(scopeDir, f)).isDirectory();
+            });
+            if (packages.length > 0) {
+                console.log("");
+                console.log("  Published packages:");
+                for (const pkg of packages) {
+                    console.log(`    @ory/${pkg}`);
+                }
+            }
+        }
+    }
+}
+async function registryPublish() {
+    console.log("");
+    console.log("Publishing all @ory/* packages to local registry...");
+    console.log("");
+    try {
+        await publishAllOryToLocal();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: ${msg}`);
+        process.exit(1);
+    }
+    console.log("");
+    console.log("Published.");
+}
+async function registryClean() {
+    // Stop first if running
+    await registryStop();
+    const registryDir = getRegistryDir();
+    if (!fs.existsSync(registryDir)) {
+        console.log("No local registry data found. Nothing to clean.");
+        return;
+    }
+    console.log(`Removing ${registryDir}...`);
+    fs.rmSync(registryDir, { recursive: true, force: true });
+    console.log("Local registry cleaned. All published packages removed.");
+}
+async function registryNpmrc() {
+    console.log("# Add this to your .npmrc or pass --registry to npm/pnpm:");
+    console.log(`registry=${config_js_1.REGISTRY_URL}/`);
+    console.log("");
+    console.log("# Or use the --registry flag:");
+    console.log(`#   npm install --registry ${config_js_1.REGISTRY_URL} @ory/<package>`);
+    console.log(`#   pnpm add --registry ${config_js_1.REGISTRY_URL} @ory/<package>`);
+}