@ory/argus 0.11.1 → 0.12.1

package/dist/ui.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Tiny, dependency-free terminal-UI kit for the interactive install flow.
+ *
+ * The install wizard is the one place a plugin talks to a human at a real
+ * terminal, so it's worth making it look the part: colored status glyphs,
+ * a framed intro banner, aligned key/value summaries, and highlighted menus.
+ * Everything here degrades gracefully — colors and Unicode glyphs are emitted
+ * only when the output is an interactive TTY that opts in, and collapse to
+ * plain ASCII otherwise. That keeps the output copy-paste-clean in logs and,
+ * crucially, byte-for-byte stable under test (where stdout isn't a TTY), so
+ * the wizard's plain-text content can still be asserted on.
+ *
+ * No external dependency: adding a prompt/print library to `@ory/argus` would
+ * push that weight onto every harness plugin that depends on core. A handful
+ * of ANSI escapes is all this needs.
+ */
+/**
+ * Whether ANSI color/style codes should be emitted. Honors the `NO_COLOR`
+ * convention and `FORCE_COLOR`, treats `TERM=dumb` as uncolored, and otherwise
+ * follows whether stdout is an interactive TTY. Evaluated per call so tests and
+ * piped output (no TTY) stay plain without any global setup.
+ */
+export declare function colorEnabled(): boolean;
+/**
+ * Color depth the terminal can render, used to pick the best representation of
+ * the brand palette (see {@link brand}):
+ *
+ *   3 — 24-bit truecolor (`COLORTERM=truecolor|24bit`, or `FORCE_COLOR=3`): the
+ *       exact Ory hex values are emitted.
+ *   2 — 256-color (`TERM` contains `256`, or `FORCE_COLOR=2`): the nearest
+ *       xterm-256 index.
+ *   1 — basic 16-color: the nearest ANSI SGR code.
+ *   0 — color disabled (see {@link colorEnabled}).
+ *
+ * Apple Terminal, for instance, advertises `xterm-256color` but not truecolor,
+ * so it lands on level 2 and still gets a recognizably-indigo accent.
+ */
+export declare function colorLevel(): 0 | 1 | 2 | 3;
+/** ANSI text stylers. Each is a no-op passthrough when color is disabled. */
+export declare const style: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    italic: (s: string) => string;
+    underline: (s: string) => string;
+    red: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    blue: (s: string) => string;
+    magenta: (s: string) => string;
+    cyan: (s: string) => string;
+    gray: (s: string) => string;
+};
+/**
+ * The Ory brand palette (from the 09/25 brand guidelines) as terminal stylers.
+ * `indigo` (#4F46E5) is the primary accent used for the banner frame, menu
+ * keys, prompts, and copyable commands; the others tint status lines. Values
+ * are the guideline hex codes with hand-picked xterm-256 / ANSI-16 fallbacks.
+ */
+export declare const brand: {
+    /** Ory Indigo #4F46E5 — primary accent. */
+    indigo: (s: string) => string;
+    /** Green #22C55E — success. */
+    green: (s: string) => string;
+    /** Yellow #FACC15 — warning. */
+    yellow: (s: string) => string;
+    /** Rose #F43F5E — error. */
+    rose: (s: string) => string;
+};
+/** Status/decoration glyphs, with ASCII fallbacks for legacy terminals. */
+export declare const glyph: {
+    success: string;
+    warning: string;
+    error: string;
+    info: string;
+    pending: string;
+    bullet: string;
+    arrow: string;
+    pointer: string;
+    gutter: string;
+};
+/** Print a blank line. */
+export declare function blank(): void;
+/**
+ * Ring the terminal bell (BEL) to pull the user's attention back to the
+ * terminal — e.g. right after a browser step, when their focus is still on the
+ * browser and the next action is in the terminal. Most terminals turn this into
+ * a dock bounce, tab badge, or attention flag. Written to stderr and only when
+ * stderr is an interactive TTY, so it's a no-op when piped or under test.
+ */
+export declare function bell(): void;
+/**
+ * Print a framed intro banner with a bold title and optional dim subtitle.
+ * The frame width tracks the longest line's *plain* length so color codes
+ * never throw off the alignment.
+ */
+export declare function banner(title: string, subtitle?: string): void;
+/** A bold section heading, preceded by a blank line to separate steps. */
+export declare function heading(text: string): void;
+/** A success line in Ory green (task completed). */
+export declare function success(text: string): void;
+/** An informational line accented in Ory indigo. */
+export declare function info(text: string): void;
+/** A dim "work in progress" line. */
+export declare function step(text: string): void;
+/** A warning line in Ory yellow, routed to stderr via console.warn. */
+export declare function warning(text: string): void;
+/** A continuation/detail warning line indented under a preceding warning. */
+export declare function warnDetail(text: string): void;
+/** An indented bullet under the current section. */
+export declare function bullet(text: string): void;
+/** An indented, dimmed hint line. */
+export declare function hint(text: string): void;
+/** An indented, indigo-highlighted shell command the user can copy-paste. */
+export declare function command(text: string): void;
+/** Inline indigo style for a command referenced mid-sentence. */
+export declare function inlineCommand(text: string): string;
+/**
+ * Print an aligned key/value summary. Labels are dimmed and right-padded to a
+ * common width (measured on plain text); values are emphasized. Skips pairs
+ * whose value is null/undefined so callers can pass optional rows inline.
+ */
+export declare function summary(pairs: Array<[string, string | undefined | null]>): void;
+export interface MenuItem {
+    /** The value the user types to pick this item (e.g. "1"). */
+    key: string;
+    /** Short bold label. */
+    label: string;
+    /** Dim one-line description shown after the label. */
+    description?: string;
+}
+/**
+ * Print a numbered menu. The typed key is highlighted, the label bold, and the
+ * description dimmed — the choice itself is still made by the caller's prompt,
+ * so this only renders the options.
+ */
+export declare function menu(items: MenuItem[]): void;
+/**
+ * Build a styled prompt string for readline. The question is bold, preceded by
+ * a pointer glyph, and an optional default/hint is dimmed. Callers keep full
+ * control of the answer parsing — this only affects presentation.
+ */
+export declare function promptLine(question: string, opts?: {
+    hint?: string;
+}): string;

package/dist/ui.js

@@ -0,0 +1,270 @@
+"use strict";
+/**
+ * Tiny, dependency-free terminal-UI kit for the interactive install flow.
+ *
+ * The install wizard is the one place a plugin talks to a human at a real
+ * terminal, so it's worth making it look the part: colored status glyphs,
+ * a framed intro banner, aligned key/value summaries, and highlighted menus.
+ * Everything here degrades gracefully — colors and Unicode glyphs are emitted
+ * only when the output is an interactive TTY that opts in, and collapse to
+ * plain ASCII otherwise. That keeps the output copy-paste-clean in logs and,
+ * crucially, byte-for-byte stable under test (where stdout isn't a TTY), so
+ * the wizard's plain-text content can still be asserted on.
+ *
+ * No external dependency: adding a prompt/print library to `@ory/argus` would
+ * push that weight onto every harness plugin that depends on core. A handful
+ * of ANSI escapes is all this needs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.glyph = exports.brand = exports.style = void 0;
+exports.colorEnabled = colorEnabled;
+exports.colorLevel = colorLevel;
+exports.blank = blank;
+exports.bell = bell;
+exports.banner = banner;
+exports.heading = heading;
+exports.success = success;
+exports.info = info;
+exports.step = step;
+exports.warning = warning;
+exports.warnDetail = warnDetail;
+exports.bullet = bullet;
+exports.hint = hint;
+exports.command = command;
+exports.inlineCommand = inlineCommand;
+exports.summary = summary;
+exports.menu = menu;
+exports.promptLine = promptLine;
+/**
+ * Whether ANSI color/style codes should be emitted. Honors the `NO_COLOR`
+ * convention and `FORCE_COLOR`, treats `TERM=dumb` as uncolored, and otherwise
+ * follows whether stdout is an interactive TTY. Evaluated per call so tests and
+ * piped output (no TTY) stay plain without any global setup.
+ */
+function colorEnabled() {
+    if (process.env.FORCE_COLOR === "0")
+        return false;
+    if (process.env.FORCE_COLOR && process.env.FORCE_COLOR !== "0")
+        return true;
+    if (process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== "")
+        return false;
+    if (process.env.TERM === "dumb")
+        return false;
+    return Boolean(process.stdout.isTTY);
+}
+/**
+ * Color depth the terminal can render, used to pick the best representation of
+ * the brand palette (see {@link brand}):
+ *
+ *   3 — 24-bit truecolor (`COLORTERM=truecolor|24bit`, or `FORCE_COLOR=3`): the
+ *       exact Ory hex values are emitted.
+ *   2 — 256-color (`TERM` contains `256`, or `FORCE_COLOR=2`): the nearest
+ *       xterm-256 index.
+ *   1 — basic 16-color: the nearest ANSI SGR code.
+ *   0 — color disabled (see {@link colorEnabled}).
+ *
+ * Apple Terminal, for instance, advertises `xterm-256color` but not truecolor,
+ * so it lands on level 2 and still gets a recognizably-indigo accent.
+ */
+function colorLevel() {
+    if (!colorEnabled())
+        return 0;
+    // An explicit FORCE_COLOR tier wins over ambient terminal hints.
+    const forced = process.env.FORCE_COLOR;
+    if (forced === "3")
+        return 3;
+    if (forced === "2")
+        return 2;
+    if (forced === "1")
+        return 1;
+    const colorterm = process.env.COLORTERM ?? "";
+    if (colorterm === "truecolor" || colorterm === "24bit")
+        return 3;
+    if (/-?256(color)?/.test(process.env.TERM ?? ""))
+        return 2;
+    return 1;
+}
+/**
+ * Whether to use Unicode box-drawing/glyph characters. Legacy Windows consoles
+ * (cmd.exe) render these poorly, so fall back to ASCII there unless we're in a
+ * modern terminal (Windows Terminal, VS Code) that handles them fine.
+ */
+function unicodeEnabled() {
+    if (process.platform !== "win32")
+        return true;
+    return Boolean(process.env.WT_SESSION) || process.env.TERM_PROGRAM === "vscode";
+}
+function wrap(open, close) {
+    return (s) => (colorEnabled() ? `\x1b[${open}m${s}\x1b[${close}m` : s);
+}
+/** ANSI text stylers. Each is a no-op passthrough when color is disabled. */
+exports.style = {
+    bold: wrap(1, 22),
+    dim: wrap(2, 22),
+    italic: wrap(3, 23),
+    underline: wrap(4, 24),
+    red: wrap(31, 39),
+    green: wrap(32, 39),
+    yellow: wrap(33, 39),
+    blue: wrap(34, 39),
+    magenta: wrap(35, 39),
+    cyan: wrap(36, 39),
+    gray: wrap(90, 39),
+};
+/** Wrap text in the best available representation of a {@link BrandColor}. */
+function paint(color) {
+    return (s) => {
+        const level = colorLevel();
+        if (level === 0)
+            return s;
+        const open = level === 3
+            ? `38;2;${color.rgb[0]};${color.rgb[1]};${color.rgb[2]}`
+            : level === 2
+                ? `38;5;${color.ansi256}`
+                : `${color.ansi16}`;
+        return `\x1b[${open}m${s}\x1b[39m`;
+    };
+}
+/**
+ * The Ory brand palette (from the 09/25 brand guidelines) as terminal stylers.
+ * `indigo` (#4F46E5) is the primary accent used for the banner frame, menu
+ * keys, prompts, and copyable commands; the others tint status lines. Values
+ * are the guideline hex codes with hand-picked xterm-256 / ANSI-16 fallbacks.
+ */
+exports.brand = {
+    /** Ory Indigo #4F46E5 — primary accent. */
+    indigo: paint({ rgb: [79, 70, 229], ansi256: 63, ansi16: 94 }),
+    /** Green #22C55E — success. */
+    green: paint({ rgb: [34, 197, 94], ansi256: 78, ansi16: 32 }),
+    /** Yellow #FACC15 — warning. */
+    yellow: paint({ rgb: [250, 204, 21], ansi256: 220, ansi16: 33 }),
+    /** Rose #F43F5E — error. */
+    rose: paint({ rgb: [244, 63, 94], ansi256: 204, ansi16: 31 }),
+};
+/** Status/decoration glyphs, with ASCII fallbacks for legacy terminals. */
+exports.glyph = {
+    success: unicodeEnabled() ? "✓" : "+",
+    warning: unicodeEnabled() ? "▲" : "!",
+    error: unicodeEnabled() ? "✗" : "x",
+    info: unicodeEnabled() ? "◇" : "*",
+    pending: unicodeEnabled() ? "○" : "o",
+    bullet: unicodeEnabled() ? "•" : "-",
+    arrow: unicodeEnabled() ? "→" : "->",
+    pointer: unicodeEnabled() ? "❯" : ">",
+    gutter: unicodeEnabled() ? "│" : "|",
+};
+const boxChars = unicodeEnabled()
+    ? { tl: "╭", tr: "╮", bl: "╰", br: "╯", h: "─", v: "│" }
+    : { tl: "+", tr: "+", bl: "+", br: "+", h: "-", v: "|" };
+/** Print a blank line. */
+function blank() {
+    console.log("");
+}
+/**
+ * Ring the terminal bell (BEL) to pull the user's attention back to the
+ * terminal — e.g. right after a browser step, when their focus is still on the
+ * browser and the next action is in the terminal. Most terminals turn this into
+ * a dock bounce, tab badge, or attention flag. Written to stderr and only when
+ * stderr is an interactive TTY, so it's a no-op when piped or under test.
+ */
+function bell() {
+    if (process.stderr.isTTY)
+        process.stderr.write("\x07");
+}
+/**
+ * Print a framed intro banner with a bold title and optional dim subtitle.
+ * The frame width tracks the longest line's *plain* length so color codes
+ * never throw off the alignment.
+ */
+function banner(title, subtitle) {
+    const rows = [title, ...(subtitle ? [subtitle] : [])];
+    const width = Math.max(...rows.map((r) => r.length));
+    const rule = boxChars.h.repeat(width + 2);
+    console.log("");
+    console.log(exports.brand.indigo(boxChars.tl + rule + boxChars.tr));
+    rows.forEach((text, i) => {
+        const pad = " ".repeat(width - text.length);
+        const content = i === 0 ? exports.style.bold(exports.brand.indigo(text)) : exports.style.dim(text);
+        console.log(exports.brand.indigo(boxChars.v) + " " + content + pad + " " + exports.brand.indigo(boxChars.v));
+    });
+    console.log(exports.brand.indigo(boxChars.bl + rule + boxChars.br));
+}
+/** A bold section heading, preceded by a blank line to separate steps. */
+function heading(text) {
+    console.log("");
+    console.log(exports.style.bold(text));
+}
+/** A success line in Ory green (task completed). */
+function success(text) {
+    console.log(`${exports.brand.green(exports.glyph.success)} ${text}`);
+}
+/** An informational line accented in Ory indigo. */
+function info(text) {
+    console.log(`${exports.brand.indigo(exports.glyph.info)} ${text}`);
+}
+/** A dim "work in progress" line. */
+function step(text) {
+    console.log(`${exports.style.dim(exports.glyph.pending)} ${text}`);
+}
+/** A warning line in Ory yellow, routed to stderr via console.warn. */
+function warning(text) {
+    console.warn(`${exports.brand.yellow(exports.glyph.warning)} ${text}`);
+}
+/** A continuation/detail warning line indented under a preceding warning. */
+function warnDetail(text) {
+    console.warn(`  ${exports.style.dim(text)}`);
+}
+/** An indented bullet under the current section. */
+function bullet(text) {
+    console.log(`  ${exports.style.dim(exports.glyph.bullet)} ${text}`);
+}
+/** An indented, dimmed hint line. */
+function hint(text) {
+    console.log(`  ${exports.style.dim(text)}`);
+}
+/** An indented, indigo-highlighted shell command the user can copy-paste. */
+function command(text) {
+    console.log(`    ${exports.brand.indigo(text)}`);
+}
+/** Inline indigo style for a command referenced mid-sentence. */
+function inlineCommand(text) {
+    return exports.brand.indigo(text);
+}
+/**
+ * Print an aligned key/value summary. Labels are dimmed and right-padded to a
+ * common width (measured on plain text); values are emphasized. Skips pairs
+ * whose value is null/undefined so callers can pass optional rows inline.
+ */
+function summary(pairs) {
+    const rows = pairs.filter((p) => p[1] != null);
+    if (rows.length === 0)
+        return;
+    const width = Math.max(...rows.map(([label]) => label.length));
+    for (const [label, value] of rows) {
+        const pad = " ".repeat(width - label.length);
+        console.log(`  ${exports.style.dim(label)}${pad}  ${value}`);
+    }
+}
+/**
+ * Print a numbered menu. The typed key is highlighted, the label bold, and the
+ * description dimmed — the choice itself is still made by the caller's prompt,
+ * so this only renders the options.
+ */
+function menu(items) {
+    for (const item of items) {
+        const key = exports.brand.indigo(`${item.key})`);
+        const label = exports.style.bold(item.label);
+        const desc = item.description ? exports.style.dim(`  ${item.description}`) : "";
+        console.log(`  ${key} ${label}${desc}`);
+    }
+}
+/**
+ * Build a styled prompt string for readline. The question is bold, preceded by
+ * a pointer glyph, and an optional default/hint is dimmed. Callers keep full
+ * control of the answer parsing — this only affects presentation.
+ */
+function promptLine(question, opts = {}) {
+    const pointer = exports.brand.indigo(exports.glyph.pointer);
+    const hintPart = opts.hint ? exports.style.dim(` ${opts.hint}`) : "";
+    return `${pointer} ${exports.style.bold(question)}${hintPart} `;
+}

package/dist/uninstall.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Credential teardown shared by every plugin's `uninstall` command.
+ *
+ * Uninstalling a plugin removes all *authentication* state from the shared
+ * config file while preserving *configuration* (project URL, OAuth2 client
+ * id, audit mode, permission mode, user-login flag). The intent is that a
+ * later re-install re-authenticates from scratch — the user logs in again
+ * and the agent registers a fresh dynamic client — rather than silently
+ * inheriting stale credentials.
+ *
+ * What is removed:
+ *   - the user's persisted OAuth2 tokens (`user`)
+ *   - the agent's dynamic-registration credentials and every sub-agent
+ *     registration (`agent`)
+ *   - the operator-supplied static agent API key (`apiKey`)
+ *   - any dangling PKCE-flight lock
+ *
+ * Before clearing local state, each dynamically-registered client (the
+ * agent and each sub-agent) is revoked server-side via RFC 7592 so the
+ * Ory project isn't left with orphaned OAuth2 clients accumulating across
+ * install/uninstall cycles. Revocation is best-effort: failures warn and
+ * local state is cleared regardless.
+ */
+export interface ClearCredentialsOptions {
+    /**
+     * Best-effort RFC 7592 `DELETE` of the agent + sub-agent dynamic clients
+     * before clearing local state. Default: `true`. Set `false` to clear
+     * local state only (offline / no network).
+     */
+    revoke?: boolean;
+    /** Sink for progress and warning lines. Default: `console.log`. */
+    log?: (message: string) => void;
+}
+export interface ClearCredentialsResult {
+    /** Whether any credential was present before clearing. */
+    hadCredentials: boolean;
+    /** Number of dynamic clients revoked server-side (includes already-gone). */
+    revoked: number;
+    /** Number of dynamic clients whose server-side revoke failed. */
+    revokeFailures: number;
+}
+/**
+ * Remove all authentication state from the shared config file, revoking
+ * dynamically-registered clients server-side first. Preserves every
+ * non-credential configuration value. Never throws.
+ */
+export declare function clearCredentialsForUninstall(options?: ClearCredentialsOptions): Promise<ClearCredentialsResult>;

package/dist/uninstall.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Credential teardown shared by every plugin's `uninstall` command.
+ *
+ * Uninstalling a plugin removes all *authentication* state from the shared
+ * config file while preserving *configuration* (project URL, OAuth2 client
+ * id, audit mode, permission mode, user-login flag). The intent is that a
+ * later re-install re-authenticates from scratch — the user logs in again
+ * and the agent registers a fresh dynamic client — rather than silently
+ * inheriting stale credentials.
+ *
+ * What is removed:
+ *   - the user's persisted OAuth2 tokens (`user`)
+ *   - the agent's dynamic-registration credentials and every sub-agent
+ *     registration (`agent`)
+ *   - the operator-supplied static agent API key (`apiKey`)
+ *   - any dangling PKCE-flight lock
+ *
+ * Before clearing local state, each dynamically-registered client (the
+ * agent and each sub-agent) is revoked server-side via RFC 7592 so the
+ * Ory project isn't left with orphaned OAuth2 clients accumulating across
+ * install/uninstall cycles. Revocation is best-effort: failures warn and
+ * local state is cleared regardless.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearCredentialsForUninstall = clearCredentialsForUninstall;
+const config_js_1 = require("./config.js");
+const agent_auth_js_1 = require("./agent-auth.js");
+const auth_store_js_1 = require("./auth-store.js");
+/**
+ * Remove all authentication state from the shared config file, revoking
+ * dynamically-registered clients server-side first. Preserves every
+ * non-credential configuration value. Never throws.
+ */
+async function clearCredentialsForUninstall(options = {}) {
+    const log = options.log ?? ((msg) => console.log(msg));
+    const revoke = options.revoke !== false;
+    const config = (0, config_js_1.loadConfig)();
+    const dynamic = config.agent?.dynamic;
+    const subAgents = config.agent?.subAgents ?? {};
+    const subAgentEntries = Object.entries(subAgents);
+    const hadCredentials = Boolean(config.user || dynamic || subAgentEntries.length > 0 || config.apiKey);
+    if (!hadCredentials) {
+        log("No stored Ory credentials to remove.");
+        return { hadCredentials: false, revoked: 0, revokeFailures: 0 };
+    }
+    let revoked = 0;
+    let revokeFailures = 0;
+    if (revoke) {
+        const targets = [];
+        if (dynamic) {
+            targets.push({
+                label: "agent client",
+                clientId: dynamic.clientId,
+                result: () => (0, agent_auth_js_1.revokeAgentDynamicClient)(dynamic),
+            });
+        }
+        for (const [type, creds] of subAgentEntries) {
+            targets.push({
+                label: `sub-agent client (${type})`,
+                clientId: creds.clientId,
+                result: () => (0, agent_auth_js_1.revokeAgentDynamicClient)(creds),
+            });
+        }
+        for (const target of targets) {
+            const outcome = await target.result();
+            if (outcome.status === "deleted") {
+                revoked++;
+                log(`  Revoked ${target.label} ${target.clientId}.`);
+            }
+            else if (outcome.status === "skipped") {
+                // No management credentials to DELETE with — nothing we can do
+                // server-side. Not counted as a failure.
+                log(`  Could not revoke ${target.label} ${target.clientId} server-side (${outcome.message}). Clearing local state anyway.`);
+            }
+            else {
+                revokeFailures++;
+                const detail = typeof outcome.httpStatus === "number"
+                    ? `HTTP ${outcome.httpStatus}`
+                    : (outcome.message ?? "unknown error");
+                log(`  Warning: server-side revoke of ${target.label} ${target.clientId} failed (${detail}). Clearing local state anyway.`);
+            }
+        }
+    }
+    // Drop every credential block; keep all configuration values.
+    (0, config_js_1.saveConfig)({ user: null, agent: null, apiKey: null });
+    (0, auth_store_js_1.clearPkceFlightLock)();
+    log("Removed stored Ory credentials (user login, agent identity, API key).");
+    return { hadCredentials: true, revoked, revokeFailures };
+}

package/dist/user-login.d.ts

@@ -17,9 +17,11 @@
  * Every terminal path emits exactly one `user.auth` trace span so that
  * the audit trail is complete regardless of outcome.
  *
- * The whole flow is a no-op (mode `disabled`) unless the
- * `ORY_USER_LOGIN` env var is set to `true` (legacy values `1`, `yes`,
- * `on` are still accepted for back-compat).
+ * The whole flow is a no-op (mode `disabled`) unless user login is
+ * enabled — either via the `ORY_USER_LOGIN` env var (values `1`, `true`,
+ * `yes`, `on`) or persisted in the shared config file (`userLogin: true`,
+ * set with `configure --user-login`). The env var overrides the config
+ * file when set.
  *
  * This authenticates the *user* (the human at the keyboard). The
  * separate agent identity (the AI process making the calls) is resolved

package/dist/user-login.js

@@ -18,9 +18,11 @@
  * Every terminal path emits exactly one `user.auth` trace span so that
  * the audit trail is complete regardless of outcome.
  *
- * The whole flow is a no-op (mode `disabled`) unless the
- * `ORY_USER_LOGIN` env var is set to `true` (legacy values `1`, `yes`,
- * `on` are still accepted for back-compat).
+ * The whole flow is a no-op (mode `disabled`) unless user login is
+ * enabled — either via the `ORY_USER_LOGIN` env var (values `1`, `true`,
+ * `yes`, `on`) or persisted in the shared config file (`userLogin: true`,
+ * set with `configure --user-login`). The env var overrides the config
+ * file when set.
  *
  * This authenticates the *user* (the human at the keyboard). The
  * separate agent identity (the AI process making the calls) is resolved
@@ -32,12 +34,14 @@ exports.ensureAuthenticated = void 0;
 exports.ensureUserAuthenticated = ensureUserAuthenticated;
 const config_js_1 = require("./config.js");
 const cli_js_1 = require("./cli.js");
+const cli_invocation_js_1 = require("./cli-invocation.js");
 const auth_store_js_1 = require("./auth-store.js");
 const auth_js_1 = require("./auth.js");
-const ENABLED_VALUES = new Set(["1", "true", "yes", "on"]);
 function isUserLoginEnabled() {
-    const v = process.env.ORY_USER_LOGIN?.toLowerCase();
-    return !!v && ENABLED_VALUES.has(v);
+    // Resolves ORY_USER_LOGIN (env, when set) over the persisted
+    // `userLogin` config flag. Centralized in resolveConfig so the gate,
+    // status CLI, and configure command stay in lockstep.
+    return (0, config_js_1.resolveConfig)().userLogin;
 }
 function clientId() {
     // resolveConfig already merges env (ORY_OAUTH2_CLIENT_ID) with the
@@ -71,7 +75,7 @@ async function ensureUserAuthenticated(client, options) {
         const decision = {
             proceed: true,
             mode: "disabled",
-            reason: "ORY_USER_LOGIN is not enabled",
+            reason: "User login is not enabled (ORY_USER_LOGIN env / userLogin config)",
         };
         recordAuthSpan(client, decision);
         return decision;
@@ -218,8 +222,8 @@ async function runUserLogin(client, options) {
         return {
             proceed: !options.allowBlock,
             mode: "skipped",
-            reason: "ORY_OAUTH2_CLIENT_ID is not set; cannot start browser login (run `npx " +
-                options.binName +
+            reason: "ORY_OAUTH2_CLIENT_ID is not set; cannot start browser login (run `" +
+                (0, cli_invocation_js_1.oryNpx)(options.binName) +
                 " configure --oauth2-client-id <id>` after registering a public OAuth2 client " +
                 "in your Ory project with all four loopback redirect URIs: " +
                 "http://127.0.0.1:47823..47826/callback)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.11.1",
+  "version": "0.12.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -72,7 +72,8 @@
     "@opentelemetry/resources": "^2.8.0",
     "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@ory/client": "^1.22.37",
-    "open": "^11.0.0"
+    "open": "^11.0.0",
+    "reo-census": "^1.2.8"
   },
   "engines": {
     "node": ">=22"