@ory/argus 0.1.1 → 0.1.2

package/dist/dev.js

@@ -127,8 +127,19 @@ function npmEnv() {
     // the local registry through an isolated pacote cache, with the user's
     // supply-chain freshness gate disabled (otherwise just-published tarballs
     // get filtered out as `ENOVERSIONS — No versions available`).
+    //
+    // `npm_config_userconfig` swaps the userconfig file from `~/.npmrc` to a
+    // launcher-managed npmrc that pins `@ory:registry` to the local Verdaccio.
+    // Without this, a developer-level `@ory:registry=…` line in their own
+    // `~/.npmrc` (left over from `npm login --scope=@ory` or similar) wins
+    // against `--registry` for scoped packages and routes the launcher's
+    // `npm install @ory/<harness>` — and the harness's own runtime `npx`
+    // calls — back to npmjs.org. The symptoms are ENOVERSIONS or tarball
+    // sha512 corruption depending on which side of the manifest/tarball
+    // split each subprocess hits.
     return {
         ...process.env,
+        npm_config_userconfig: (0, manager_js_1.ensureLauncherNpmrc)(),
         npm_config_registry: config_js_1.REGISTRY_URL,
         npm_config_cache: (0, manager_js_1.getLocalRegistryNpmCacheDir)(),
         npm_config_min_release_age: "0",

package/dist/registry/config.d.ts

@@ -21,3 +21,20 @@ export declare const REGISTRY_CONTAINER_STORAGE = "/verdaccio/storage";
 export declare const REGISTRY_CONTAINER_CONFIG = "/verdaccio/conf/config.yaml";
 export declare function verdaccioConfigYaml(): string;
 export declare function npmrcContent(): string;
+/**
+ * Userconfig file used by the dev launcher's npm/npx subprocesses.
+ *
+ * The scope-specific `@ory:registry=…` line is the critical bit. If a
+ * developer has ever run `npm login --scope=@ory` (or otherwise pinned
+ * `@ory:registry` in their `~/.npmrc`) to publish or fetch from npmjs.org,
+ * that pin takes precedence over `--registry` / `npm_config_registry` for
+ * scoped packages — so the launcher's `npm install @ory/<harness>` and the
+ * harness's own runtime `npx -y -p @ory/<harness>` calls silently hit
+ * npmjs.org instead of localhost, producing either `ENOVERSIONS` (because
+ * npmjs's manifest doesn't list the just-bumped local version) or a tarball
+ * sha512 mismatch (when the local manifest is consulted but npmjs serves
+ * the bytes). We expose this file as `npm_config_userconfig` so it
+ * displaces `~/.npmrc` entirely for subprocesses the launcher spawns,
+ * without modifying any global config or polluting the sandbox.
+ */
+export declare function launcherNpmrcContent(): string;

package/dist/registry/config.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.REGISTRY_CONTAINER_CONFIG = exports.REGISTRY_CONTAINER_STORAGE = exports.REGISTRY_CONTAINER = exports.REGISTRY_IMAGE = exports.REGISTRY_DIR_NAME = exports.REGISTRY_URL = exports.REGISTRY_PORT = void 0;
 exports.verdaccioConfigYaml = verdaccioConfigYaml;
 exports.npmrcContent = npmrcContent;
+exports.launcherNpmrcContent = launcherNpmrcContent;
 exports.REGISTRY_PORT = 4873;
 exports.REGISTRY_URL = `http://localhost:${exports.REGISTRY_PORT}`;
 exports.REGISTRY_DIR_NAME = ".ory-dev/registry";
@@ -44,15 +45,22 @@ uplinks:
     cache: false
 
 packages:
+  # @ory/client is a transitive Ory SDK dep that lives on npmjs.org — proxy
+  # it so installs can resolve it from upstream.
+  "@ory/client":
+    access: $all
+    publish: $all
+    proxy: npmjs
+
+  # All other @ory/* packages are workspace packages we publish locally.
+  # No proxy: if upstream were consulted, Verdaccio would merge npmjs.org's
+  # already-published versions into the manifest and reject every republish
+  # at the same version with "cannot publish over previously published
+  # versions: X.Y.Z".
   "@ory/*":
     access: $all
     publish: $all
     unpublish: $all
-    # Locally-published workspace packages (e.g. @ory/argus) are served from
-    # storage; everything else under @ory/* (notably @ory/client, a transitive
-    # dep) falls through to npmjs. Without this, transitive @ory/client
-    # resolution fails with E404 against the local registry.
-    proxy: npmjs
 
   "**":
     access: $all
@@ -78,3 +86,26 @@ function npmrcContent() {
 //localhost:${exports.REGISTRY_PORT}/:_authToken=local-dev-token
 `;
 }
+/**
+ * Userconfig file used by the dev launcher's npm/npx subprocesses.
+ *
+ * The scope-specific `@ory:registry=…` line is the critical bit. If a
+ * developer has ever run `npm login --scope=@ory` (or otherwise pinned
+ * `@ory:registry` in their `~/.npmrc`) to publish or fetch from npmjs.org,
+ * that pin takes precedence over `--registry` / `npm_config_registry` for
+ * scoped packages — so the launcher's `npm install @ory/<harness>` and the
+ * harness's own runtime `npx -y -p @ory/<harness>` calls silently hit
+ * npmjs.org instead of localhost, producing either `ENOVERSIONS` (because
+ * npmjs's manifest doesn't list the just-bumped local version) or a tarball
+ * sha512 mismatch (when the local manifest is consulted but npmjs serves
+ * the bytes). We expose this file as `npm_config_userconfig` so it
+ * displaces `~/.npmrc` entirely for subprocesses the launcher spawns,
+ * without modifying any global config or polluting the sandbox.
+ */
+function launcherNpmrcContent() {
+    return `registry=${exports.REGISTRY_URL}/
+@ory:registry=${exports.REGISTRY_URL}/
+//localhost:${exports.REGISTRY_PORT}/:_authToken=local-dev-token
+min-release-age=0
+`;
+}

package/dist/registry/manager.d.ts

@@ -19,6 +19,17 @@
  * pnpm publish/npm install even after we drop the version from Verdaccio.
  */
 export declare function getLocalRegistryNpmCacheDir(): string;
+/**
+ * Path to the userconfig npmrc the dev launcher hands to its subprocesses.
+ * See `launcherNpmrcContent` in `./config.ts` for why this exists.
+ */
+export declare function getLauncherNpmrcPath(): string;
+/**
+ * Materialize the launcher userconfig npmrc on disk and return its path.
+ * Idempotent: rewrites the file every call so any drift in the rendered
+ * content (e.g. registry URL change) lands without a clean-and-restart.
+ */
+export declare function ensureLauncherNpmrc(): string;
 /**
  * Start the local registry if it isn't already running.
  */

package/dist/registry/manager.js

@@ -46,6 +46,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLocalRegistryNpmCacheDir = getLocalRegistryNpmCacheDir;
+exports.getLauncherNpmrcPath = getLauncherNpmrcPath;
+exports.ensureLauncherNpmrc = ensureLauncherNpmrc;
 exports.ensureRegistryRunning = ensureRegistryRunning;
 exports.publishHarnessToLocal = publishHarnessToLocal;
 exports.registryStart = registryStart;
@@ -84,6 +86,24 @@ function getRegistryDir() {
 function getLocalRegistryNpmCacheDir() {
     return path.join(getRegistryDir(), "npm-cache");
 }
+/**
+ * Path to the userconfig npmrc the dev launcher hands to its subprocesses.
+ * See `launcherNpmrcContent` in `./config.ts` for why this exists.
+ */
+function getLauncherNpmrcPath() {
+    return path.join(getRegistryDir(), "launcher.npmrc");
+}
+/**
+ * Materialize the launcher userconfig npmrc on disk and return its path.
+ * Idempotent: rewrites the file every call so any drift in the rendered
+ * content (e.g. registry URL change) lands without a clean-and-restart.
+ */
+function ensureLauncherNpmrc() {
+    const npmrcPath = getLauncherNpmrcPath();
+    ensureDir(path.dirname(npmrcPath));
+    fs.writeFileSync(npmrcPath, (0, config_js_1.launcherNpmrcContent)());
+    return npmrcPath;
+}
 function ensureDir(dir) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -176,15 +196,28 @@ async function withLocalPublishConfig(workspaceRoot, fn) {
 async function cleanScopeStorage() {
     // Verdaccio caches package metadata in memory; deleting on-disk storage
     // alone leaves stale manifests served and causes publish to report
-    // "already exists". Issue an HTTP DELETE for every known scoped package
-    // first (Verdaccio drops both memory + disk state), then remove any
-    // residual scope dir for completeness.
+    // "already exists". Issue an authenticated HTTP DELETE for every known
+    // scoped package first (Verdaccio drops both memory + disk state), then
+    // remove any residual scope dir for completeness.
+    //
+    // The Authorization header is required: Verdaccio silently rejects
+    // unauthenticated DELETEs, leaves its in-memory manifest intact, and then
+    // rewrites the on-disk `package.json` from that cache on the next publish
+    // — so the second publish sees the stale versions and fails with
+    // "cannot publish over previously published versions".
     const root = findProjectRoot(process.cwd());
     const names = listWorkspaceScopedPackages(root);
+    const token = readToken(getRegistryDir());
+    const headers = token
+        ? { Authorization: `Bearer ${token}` }
+        : {};
     await Promise.all(names.map(async (name) => {
         const encoded = name.replace("/", "%2f");
         try {
-            await fetch(`${config_js_1.REGISTRY_URL}/${encoded}/-rev/0`, { method: "DELETE" });
+            await fetch(`${config_js_1.REGISTRY_URL}/${encoded}/-rev/0`, {
+                method: "DELETE",
+                headers,
+            });
         }
         catch {
             // Best-effort.
@@ -292,6 +325,48 @@ async function registerDevUser(registryDir) {
     fs.writeFileSync(getTokenFile(registryDir), token);
     return token;
 }
+/**
+ * Restart the registry container if the rendered Verdaccio config has
+ * drifted from what's on disk. Verdaccio 6 does not hot-reload `config.yaml`,
+ * so a config change in the codebase has no effect on a running container
+ * until it restarts — and a stale config can silently keep mis-routing
+ * publishes through the upstream proxy. Called from `publishAllOryToLocal`
+ * so any code-bundled policy fix lands without an explicit `registry:clean`.
+ */
+async function ensureConfigInSync(quiet) {
+    const registryDir = getRegistryDir();
+    // If the registry dir doesn't exist here, the running container was
+    // started from a different cwd (e.g. main repo while we're in a worktree,
+    // or vice versa). We don't own the on-disk state and writing a config
+    // file at this path wouldn't reach the container's bind mount anyway.
+    // Skip silently — the downstream auth-token check will surface a clear
+    // error if the caller actually needs local registry state.
+    if (!fs.existsSync(registryDir))
+        return;
+    const configPath = path.join(registryDir, "config.yaml");
+    const expected = (0, config_js_1.verdaccioConfigYaml)();
+    const current = fs.existsSync(configPath)
+        ? fs.readFileSync(configPath, "utf-8")
+        : "";
+    if (current === expected)
+        return;
+    if (!quiet) {
+        console.log("Verdaccio config out of date — restarting registry...");
+    }
+    fs.writeFileSync(configPath, expected);
+    const restart = (0, node_child_process_1.spawnSync)("docker", ["restart", config_js_1.REGISTRY_CONTAINER], {
+        stdio: ["ignore", "ignore", "pipe"],
+        encoding: "utf-8",
+    });
+    if (restart.status !== 0) {
+        const stderr = (restart.stderr ?? "").toString().trim();
+        throw new Error(`Failed to restart registry container after config change (exit ${restart.status}): ${stderr}`);
+    }
+    const ready = await waitForRegistry();
+    if (!ready) {
+        throw new Error("Registry did not come back online after config restart within 30 seconds.");
+    }
+}
 // ─── Public lifecycle ──────────────────────────────────────────────
 /**
  * Start the local registry if it isn't already running.
@@ -362,6 +437,7 @@ async function publishAllOryToLocal(opts = {}) {
     if (!isRegistryRunning()) {
         throw new Error("Local registry is not running. Call ensureRegistryRunning() first.");
     }
+    await ensureConfigInSync(opts.quiet);
     const registryDir = getRegistryDir();
     const token = readToken(registryDir);
     if (!token) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",