@ory/argus 0.13.8 → 0.14.0

package/dist/config.d.ts

@@ -30,6 +30,27 @@ export interface OryUserCredentials {
  * restarts re-use the same agent identity instead of re-registering on
  * every session.
  */
+/**
+ * The delegation edge recorded on a dynamically-registered OAuth2 client's
+ * `metadata` at registration time (see {@link OryAgentDynamicCredentials.delegation}).
+ *
+ * This is the **integrity anchor** for the delegation chain: it is bound to
+ * the OAuth2 client identity durably owned by Hydra / Ory Network and mirrored
+ * into local config, so the delegator can be resolved — and the derived Keto
+ * tuple rebuilt — even if the tuple is lost, corrupted, or never written.
+ */
+export interface OryDelegationRecord {
+    /** The delegator, as a namespaced subject: `user:<sub>` or `agent:<sub>`. */
+    delegatedBy: string;
+    /** Which edge of the chain this client sits on. */
+    delegationType: "user-to-agent" | "agent-to-subagent";
+    /** Harness the delegation was established under (audit aid). */
+    harness?: string;
+    /** Sub-agent type, present only for `agent-to-subagent`. */
+    subAgentType?: string;
+    /** ISO-8601 timestamp the delegation was stamped. */
+    delegatedAt: string;
+}
 export interface OryAgentDynamicCredentials {
     /** Issued client_id. */
     clientId: string;
@@ -45,6 +66,14 @@ export interface OryAgentDynamicCredentials {
     projectUrl: string;
     /** Harness name baked into the client_name (audit aid). */
     harness?: string;
+    /**
+     * The delegation edge recorded for this client at registration. Persisted
+     * here in local config only — Ory's public DCR endpoint rejects a `metadata`
+     * field, so it is never stored server-side. Absent when the delegator wasn't
+     * known at registration time (e.g. DCR bootstrapped from an out-of-band
+     * initial access token with no user/agent principal).
+     */
+    delegation?: OryDelegationRecord;
 }
 /** Credentials for the AI agent principal (machine identity). */
 export interface OryAgentCredentialsBlock {
@@ -88,10 +117,26 @@ export interface OryPluginConfig {
      * never be substituted for a slug when building it.
      */
     projectId?: string;
+    /**
+     * Human-readable project and workspace names, captured at install time for
+     * display only (e.g. the dashboard's connected-stack card). Not used to
+     * address any API — {@link projectUrl} / {@link projectId} do that.
+     */
+    projectName?: string;
+    workspaceName?: string;
     apiKey?: string;
+    /**
+     * Token id of the project API key stored in {@link apiKey}, captured when the
+     * installer mints the key via the Ory Console API. Ory only returns a key's
+     * secret at creation and deletion addresses the token by id (not by its
+     * secret value), so the id is persisted here purely so `uninstall` can delete
+     * the key server-side. Absent for keys minted before id-tracking, or supplied
+     * by hand via `configure --api-key`.
+     */
+    apiKeyId?: string;
     /**
      * Public OAuth2 client id used by the user PKCE browser flow when
-     * `ORY_USER_LOGIN` is on. The client must be registered ahead of time
+     * the interactive user login runs (every session). The client must be registered ahead of time
      * in the Ory project with all four loopback redirect URIs
      * (`http://127.0.0.1:47823..47826/callback`) and
      * `token_endpoint_auth_method=none`. The local stack provisions one
@@ -107,14 +152,6 @@ export interface OryPluginConfig {
      * tuple set is correct. See {@link PermissionMode}.
      */
     permissionMode?: PermissionMode;
-    /**
-     * Whether the interactive user PKCE login runs at session start. When
-     * true, every session runs `ensureUserAuthenticated`; when unset the
-     * flow is a no-op. Set via `configure --user-login` / `--no-user-login`.
-     * The `ORY_USER_LOGIN` env var overrides this when set. Requires an
-     * OAuth2 client id ({@link oauth2ClientId}) to actually complete a login.
-     */
-    userLogin?: boolean;
     /**
      * Permission-check subject namespace for the human user. When set, the
      * user is addressed as a SubjectSet `<namespace>:<subject>` in permission
@@ -159,14 +196,6 @@ export declare function getConfigPath(): string;
  * does not exist or is invalid.
  */
 export declare function loadConfig(): OryPluginConfig;
-/**
- * Read `ORY_USER_LOGIN` from the environment. Returns `true`/`false` when
- * the var is set (any recognized truthy value enables it; anything else
- * disables it), or `undefined` when the var is absent/empty so callers
- * fall back to the config file. Centralized here so the user gate, status
- * CLI, and configure command resolve it identically.
- */
-export declare function parseUserLoginEnv(): boolean | undefined;
 /**
  * Save config to the config file. Merges with existing values — only
  * provided fields are overwritten. Concurrent processes serialize via a
@@ -209,13 +238,13 @@ export declare function looksLikeProjectId(value: string): boolean;
 export declare function resolveConfig(): {
     projectUrl?: string;
     projectId?: string;
+    projectName?: string;
+    workspaceName?: string;
     apiKey?: string;
     oauth2ClientId?: string;
     auditOnly: boolean;
     permissionMode: PermissionMode;
     permissionModeSource: "env" | "config" | "default";
-    userLogin: boolean;
-    userLoginSource: "env" | "config" | "default";
     userSubjectNamespace?: string;
     userSubjectNamespaceSource: "env" | "config" | "none";
     projectUrlSource: "env" | "config" | "none";

package/dist/config.js

@@ -37,7 +37,6 @@ exports.getDataDir = getDataDir;
 exports.getHarnessDataDir = getHarnessDataDir;
 exports.getConfigPath = getConfigPath;
 exports.loadConfig = loadConfig;
-exports.parseUserLoginEnv = parseUserLoginEnv;
 exports.saveConfig = saveConfig;
 exports.mutateConfig = mutateConfig;
 exports.looksLikeProjectId = looksLikeProjectId;
@@ -120,11 +119,19 @@ function loadConfig() {
             projectId: typeof parsed.projectId === "string" && parsed.projectId.trim()
                 ? parsed.projectId.trim()
                 : undefined,
+            projectName: typeof parsed.projectName === "string" && parsed.projectName.trim()
+                ? parsed.projectName.trim()
+                : undefined,
+            workspaceName: typeof parsed.workspaceName === "string" && parsed.workspaceName.trim()
+                ? parsed.workspaceName.trim()
+                : undefined,
             apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey : undefined,
+            apiKeyId: typeof parsed.apiKeyId === "string" && parsed.apiKeyId.trim()
+                ? parsed.apiKeyId.trim()
+                : undefined,
             oauth2ClientId: typeof parsed.oauth2ClientId === "string" ? parsed.oauth2ClientId : undefined,
             auditOnly: parsed.auditOnly === true ? true : undefined,
             permissionMode: parsePermissionMode(parsed.permissionMode),
-            userLogin: typeof parsed.userLogin === "boolean" ? parsed.userLogin : undefined,
             userSubjectNamespace: typeof parsed.userSubjectNamespace === "string" && parsed.userSubjectNamespace.trim()
                 ? parsed.userSubjectNamespace.trim()
                 : undefined,
@@ -139,21 +146,6 @@ function loadConfig() {
 function parsePermissionMode(value) {
     return value === "observe" || value === "enforce" ? value : undefined;
 }
-/** Env values that turn the interactive user login on. */
-const USER_LOGIN_ENABLED_VALUES = new Set(["1", "true", "yes", "on"]);
-/**
- * Read `ORY_USER_LOGIN` from the environment. Returns `true`/`false` when
- * the var is set (any recognized truthy value enables it; anything else
- * disables it), or `undefined` when the var is absent/empty so callers
- * fall back to the config file. Centralized here so the user gate, status
- * CLI, and configure command resolve it identically.
- */
-function parseUserLoginEnv() {
-    const raw = process.env.ORY_USER_LOGIN;
-    if (raw === undefined || raw.trim() === "")
-        return undefined;
-    return USER_LOGIN_ENABLED_VALUES.has(raw.trim().toLowerCase());
-}
 function parseAgentCredentials(parsed) {
     const raw = parsed.agent;
     if (!raw || typeof raw !== "object")
@@ -197,6 +189,26 @@ function parseAgentDynamicCredentials(value) {
         registeredAt,
         projectUrl: v.projectUrl,
         harness: typeof v.harness === "string" ? v.harness : undefined,
+        ...(parseDelegationRecord(v.delegation)
+            ? { delegation: parseDelegationRecord(v.delegation) }
+            : {}),
+    };
+}
+function parseDelegationRecord(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const v = value;
+    if (typeof v.delegatedBy !== "string" || v.delegatedBy.length === 0)
+        return undefined;
+    if (v.delegationType !== "user-to-agent" && v.delegationType !== "agent-to-subagent") {
+        return undefined;
+    }
+    return {
+        delegatedBy: v.delegatedBy,
+        delegationType: v.delegationType,
+        ...(typeof v.harness === "string" ? { harness: v.harness } : {}),
+        ...(typeof v.subAgentType === "string" ? { subAgentType: v.subAgentType } : {}),
+        delegatedAt: typeof v.delegatedAt === "string" ? v.delegatedAt : "",
     };
 }
 function parseUserCredentials(parsed) {
@@ -411,7 +423,6 @@ function resolveConfig() {
     const envApiKey = process.env.ORY_AGENT_API_KEY ?? process.env.ORY_API_KEY;
     const envClientId = process.env.ORY_OAUTH2_CLIENT_ID;
     const envMode = parsePermissionMode(process.env.ORY_PERMISSION_MODE);
-    const envUserLogin = parseUserLoginEnv();
     const envUserSubjectNamespace = process.env.ORY_USER_SUBJECT_NAMESPACE?.trim() || undefined;
     const permissionMode = envMode ?? file.permissionMode ?? "observe";
     const permissionModeSource = envMode
@@ -419,12 +430,6 @@ function resolveConfig() {
         : file.permissionMode
             ? "config"
             : "default";
-    const userLogin = envUserLogin ?? file.userLogin ?? false;
-    const userLoginSource = envUserLogin !== undefined
-        ? "env"
-        : file.userLogin !== undefined
-            ? "config"
-            : "default";
     const projectId = envProjectId ?? file.projectId;
     // The SDK URL is only ever an explicit, slug-based URL (from ORY_PROJECT_URL,
     // ORY_SDK_URL, or the config file). The project id is NOT a URL source — it
@@ -438,13 +443,13 @@ function resolveConfig() {
     return {
         projectUrl,
         projectId,
+        projectName: file.projectName,
+        workspaceName: file.workspaceName,
         apiKey: envApiKey ?? file.apiKey,
         oauth2ClientId: envClientId ?? file.oauth2ClientId,
         auditOnly: file.auditOnly === true,
         permissionMode,
         permissionModeSource,
-        userLogin,
-        userLoginSource,
         userSubjectNamespace: envUserSubjectNamespace ?? file.userSubjectNamespace,
         userSubjectNamespaceSource: envUserSubjectNamespace
             ? "env"

package/dist/contract-suite.d.ts

@@ -61,10 +61,12 @@ export interface HarnessContractAdapter {
     /** A real, non-interactive tool from this harness's catalog. */
     tool: string;
     /**
-     * Whether the harness's session-start primitive can carry a hard block
-     * (subprocess exit-code harnesses: true; in-process advisory: false).
+     * @deprecated Ignored. Session start is now uniformly non-blocking on every
+     * harness (authentication never blocks; enforcement is governed by
+     * `permissionMode` at tool-call time). Kept optional so existing adapters
+     * that still pass it type-check.
      */
-    sessionCanBlock: boolean;
+    sessionCanBlock?: boolean;
     /** Whether the tool gate can hard-block. Defaults to true. */
     toolCanBlock?: boolean;
     /** Set false when the plugin has no legacy OAuth2-token session path. */

package/dist/contract-suite.js

@@ -36,12 +36,12 @@ exports.runHarnessContractSuite = runHarnessContractSuite;
 const vitest_1 = require("vitest");
 const config_js_1 = require("./config.js");
 const testing_js_1 = require("./testing.js");
-const DISABLED_DECISION = {
+const DEFAULT_DECISION = {
     proceed: true,
-    mode: "disabled",
-    reason: "ORY_USER_LOGIN not enabled",
+    mode: "skipped",
+    reason: "no cached user identity in contract suite",
 };
-function makeGates(userDecision = DISABLED_DECISION) {
+function makeGates(userDecision = DEFAULT_DECISION) {
     return {
         userLogin: vitest_1.vi.fn(async () => userDecision),
         agentGate: vitest_1.vi.fn(async () => ({
@@ -125,42 +125,33 @@ function runHarnessContractSuite(adapter) {
                 (0, vitest_1.expect)(outcome.blocked).toBe(false);
             });
         });
-        // ── User-login gate translation ────────────────────────────────
+        // ── User-login gate is advisory (never blocks the session) ─────
         (0, vitest_1.describe)("user-login gate", () => {
             const declined = {
                 proceed: false,
                 mode: "declined",
                 reason: "User declined the OAuth2 consent screen",
             };
-            (0, vitest_1.it)(adapter.sessionCanBlock
-                ? "translates a declined login into the native session block"
-                : "treats a declined login as advisory (no session block channel)", async () => {
+            (0, vitest_1.it)("never blocks the session even when the user login declines", async () => {
+                // Authentication is non-blocking on every harness; enforcement is
+                // governed by permissionMode at tool-call time, not here.
                 const gates = makeGates(declined);
                 const outcome = await adapter.sessionStart(ctx(gates));
-                (0, vitest_1.expect)(outcome.blocked).toBe(adapter.sessionCanBlock);
-                if (adapter.sessionCanBlock) {
-                    (0, vitest_1.expect)(outcome.reason).toBeTruthy();
-                }
+                (0, vitest_1.expect)(outcome.blocked).toBe(false);
             });
             (0, vitest_1.it)("runs the agent gate even when the user gate declines", async () => {
                 const gates = makeGates(declined);
                 await adapter.sessionStart(ctx(gates));
                 (0, vitest_1.expect)(gates.agentGate).toHaveBeenCalledOnce();
             });
-            (0, vitest_1.it)("proceeds without legacy verification when the gate handled auth", async () => {
+            (0, vitest_1.it)("never runs a legacy session-token verification path", async () => {
+                // The user gate owns authentication; there is no separate legacy
+                // verify/introspect fall-through any longer.
                 process.env.ORY_SESSION_TOKEN = "should-not-be-verified";
                 const verify = (0, testing_js_1.stubSessionSuccess)(client);
-                const gates = makeGates({ proceed: true, mode: "ok", reason: "logged in" });
-                const outcome = await adapter.sessionStart(ctx(gates));
-                (0, vitest_1.expect)(outcome.blocked).toBe(false);
-                (0, vitest_1.expect)(verify).not.toHaveBeenCalled();
-            });
-            (0, vitest_1.it)("falls through to legacy verification when the gate is disabled", async () => {
-                process.env.ORY_SESSION_TOKEN = "legacy-token";
-                const verify = (0, testing_js_1.stubSessionSuccess)(client);
                 const outcome = await adapter.sessionStart(ctx());
                 (0, vitest_1.expect)(outcome.blocked).toBe(false);
-                (0, vitest_1.expect)(verify).toHaveBeenCalled();
+                (0, vitest_1.expect)(verify).not.toHaveBeenCalled();
             });
         });
         // ── Tool gate translation ──────────────────────────────────────

package/dist/dashboard-cli.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Entry point invoked by each harness CLI's `dashboard` case. Returns the
+ * intended process exit code; never throws. With `--json` (or when no browser
+ * can be opened) it prints the report and resolves immediately; otherwise it
+ * opens the web app in `status` mode and resolves when the SPA requests
+ * shutdown or the user interrupts (Ctrl+C).
+ */
+export declare function runDashboardCommand(binName: string, harness: string, args: string[]): Promise<number>;

package/dist/dashboard-cli.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDashboardCommand = runDashboardCommand;
+/**
+ * Shared `dashboard` CLI implementation. Each harness's `cli/main.ts`
+ * delegates `<bin> dashboard` here.
+ *
+ * The dashboard is the live status view of the plugin, and one of the two
+ * surfaces of the Ory Agent web app (the other being the guided installer): it
+ * opens that app in `status` mode via {@link file://./web/launch.ts}'s
+ * `launchWebDashboard`, reusing the same loopback server + React SPA. The data
+ * it renders is the shared {@link file://./status-data.ts} `StatusReport`,
+ * which the dashboard extends with a "System information" section — the health
+ * of the core Ory services (Kratos, Hydra, Keto) from
+ * {@link file://./status-system.ts}.
+ *
+ * Besides reading status, the dashboard exposes a "Change stack" action that
+ * hands off to the same guided wizard the installer uses (embedded, starting on
+ * the stack chooser) so the user can reconfigure which Ory stack the plugin runs
+ * against — Ory Network, the local stack, or audit-only — without leaving the
+ * browser. It reuses the shared install API and reloads status on return.
+ *
+ * Flags:
+ *   --json   Print the status report as JSON and exit (no server). Also the
+ *            automatic fallback when a browser can't be opened (headless / CI).
+ */
+const launch_js_1 = require("./web/launch.js");
+const status_data_js_1 = require("./status-data.js");
+const cli_invocation_js_1 = require("./cli-invocation.js");
+function printDashboardHelp(binName) {
+    console.log(`Usage: ${binName} dashboard [options]`);
+    console.log("");
+    console.log("Open the Ory Agent dashboard in your browser — a live view of the");
+    console.log("plugin's configuration and the health of the core Ory services (Kratos,");
+    console.log("Hydra, Keto), refreshing live. It is the status surface of the same web");
+    console.log("app that powers the guided installer, and its \"Change stack\" action lets");
+    console.log("you reconfigure which Ory stack the plugin runs against.");
+    console.log("");
+    console.log("Options:");
+    console.log("  --json   Print the status report as JSON and exit (no server)");
+    console.log("");
+    console.log(`  ${(0, cli_invocation_js_1.oryNpx)(binName)} dashboard`);
+}
+/**
+ * Entry point invoked by each harness CLI's `dashboard` case. Returns the
+ * intended process exit code; never throws. With `--json` (or when no browser
+ * can be opened) it prints the report and resolves immediately; otherwise it
+ * opens the web app in `status` mode and resolves when the SPA requests
+ * shutdown or the user interrupts (Ctrl+C).
+ */
+async function runDashboardCommand(binName, harness, args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        printDashboardHelp(binName);
+        return 0;
+    }
+    // `--json`, or any environment where we can't open a browser (CI, no TTY,
+    // no display), falls back to the machine-readable report on stdout.
+    if (args.includes("--json") || !(0, launch_js_1.canLaunchBrowser)()) {
+        const report = await (0, status_data_js_1.collectStatusReport)(harness);
+        console.log(JSON.stringify(report, null, 2));
+        return 0;
+    }
+    const launched = await (0, launch_js_1.launchWebDashboard)(binName, harness);
+    if (!launched) {
+        console.error("Could not start the dashboard server.");
+        console.error(`Use "${(0, cli_invocation_js_1.oryNpx)(binName)} dashboard --json" for the raw report instead.`);
+        return 1;
+    }
+    return 0;
+}

package/dist/dev.js

@@ -417,9 +417,8 @@ function buildLocalOryEnv(gatewayUrl, seed) {
     return {
         ORY_PROJECT_URL: gatewayUrl,
         ORY_PERMISSION_NAMESPACE: seed.permissions.namespace,
-        // User login — always on in local dev so the launcher demonstrates
-        // the interactive PKCE login UX end-to-end every session.
-        ORY_USER_LOGIN: "true",
+        // User login runs every session (always on); no flag needed. The launcher
+        // demonstrates the interactive PKCE login UX end-to-end.
         // Agent identity — the harness self-registers via DCR on first run
         // using the user's bearer as the initial access token. No static
         // client_credentials are seeded; explicitly clear them so a leaking
@@ -498,7 +497,7 @@ async function bootstrapLocalOry(localDir) {
         console.warn(`[ory-dev] Local Ory: seed failed (${msg}). Continuing without local Ory.`);
         return { active: false };
     }
-    console.log(`[ory-dev] Local Ory: agent ${seed.agent.identity.email}, user ${seed.user.identity.email}, ` +
+    console.log(`[ory-dev] Local Ory: user ${seed.user.identity.email}, ` +
         `${seed.permissions.tuples} permissions in '${namespace}' for ${seed.permissions.subject}.`);
     return { active: true, gatewayUrl, seed };
 }

package/dist/index.d.ts

@@ -1,11 +1,11 @@
 export { OryAgentClient, type OryAgentConfig, type PrincipalIdentity, } from "./client.js";
 export { DebugLogger, redactLogData, withQuietStderr, type LogEntry, type LogLevel, } from "./logger.js";
 export { Tracer, ActiveSpan, deriveTraceId, formatSpan, watchTraceFile, type TraceEvent, type SpanStatus, type TraceSpan, type SpanOptions, type TracerOptions, type TracerContext, type SpanAttributeEnricher, } from "./tracer.js";
-export { loadConfig, saveConfig, resolveConfig, mutateConfig, getConfigPath, getDataDir, getHarnessDataDir, type OryPluginConfig, type OryOAuth2Tokens, type OryUserCredentials, type OryAgentCredentialsBlock, type OryAgentDynamicCredentials, type PermissionMode, } from "./config.js";
+export { loadConfig, saveConfig, resolveConfig, mutateConfig, getConfigPath, getDataDir, getHarnessDataDir, type OryPluginConfig, type OryOAuth2Tokens, type OryUserCredentials, type OryAgentCredentialsBlock, type OryAgentDynamicCredentials, type OryDelegationRecord, type PermissionMode, } from "./config.js";
 export { pkceLogin, refreshAccessToken, detectHeadless, generateCodeVerifier, sha256Base64Url, buildAuthorizeUrl, LOOPBACK_PORTS, DEFAULT_LOGIN_TIMEOUT_MS, type PkceLoginOptions, type PkceLoginOutcome, type PkceDeclineReason, } from "./auth.js";
 export { loadTokens, saveTokens, clearTokens, isExpired, refreshAndSave, tryAcquirePkceFlightLock, clearPkceFlightLock, waitForPeerTokens, waitForPeerTokensSync, TOKEN_EXPIRY_SKEW_SEC, type PkceFlightLock, } from "./auth-store.js";
 export { ensureUserAuthenticated, ensureAuthenticated, type UserLoginDecision, type UserLoginMode, type UserLoginOptions, } from "./user-login.js";
-export { resolveAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, saveAgentDynamicCredentials, clearAgentDynamicCredentials, loadSubAgentDynamicCredentials, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, revokeAgentDynamicClient, AGENT_TOKEN_EXPIRY_SKEW_SEC, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type RevokeAgentClientResult, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
+export { resolveAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, saveAgentDynamicCredentials, clearAgentDynamicCredentials, loadSubAgentDynamicCredentials, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, revokeAgentDynamicClient, AGENT_TOKEN_EXPIRY_SKEW_SEC, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type DelegationInput, type RevokeAgentClientResult, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
 export { clearCredentialsForUninstall, type ClearCredentialsOptions, type ClearCredentialsResult, } from "./uninstall.js";
 export { type SessionInfo, type OAuth2TokenInfo, type PermissionCheck, type PermissionResult, type BatchPermissionResult, type OryError, type OryErrorCode, } from "./types.js";
 export { runConfigureCommand, runAgentCommand, printOryConfig, printEnvironment, printLogTail, printEnvHelp, printTraceTail, runWatchCommand, isTtyAvailable, promptOnTty, promptForProjectUrl, interactiveConfigPrompt, } from "./cli.js";
@@ -13,12 +13,17 @@ export { oryNpx } from "./cli-invocation.js";
 export { runPermissionsCommand, isUserIdentityCached, maybeAutoBootstrap, printPermissionsOnboardingHelp, } from "./permissions-cli.js";
 export { runInteractiveSetup, runPostInstall, projectUrlFromSlug, LOOPBACK_REDIRECT_URIS, type OryCliRunner, type OryExecResult, type InteractiveSetupDeps, type InteractiveSetupOutcome, type InteractiveSetupResult, } from "./interactive-setup.js";
 export { runStatusCommand, printUserIdentitySection, printAgentIdentitySection, printPermissionsSection, type StatusCommandOptions, } from "./status-cli.js";
+export { collectStatusReport, probePermissionsCoverage, type StatusReport, type StatusConfigSection, type StatusUserSection, type StatusAgentSection, type StatusPermissionsSection, type StatusActivitySection, type PermissionsCoverage, } from "./status-data.js";
+export { ensureOryCli, isSignedIn, listWorkspaces, createWorkspace, createProject, resolveProjectUrl, getDcrState, enableDcrAction, provisionOAuth2Client, saveNetworkConfig, runFullSetup, inspectPermissions, provisionPermissions, grantToolPermissions, provisionProjectApiKey, configureAuditOnly, configureLocalStack, type SetupActionDeps, type LocalStackResult, type FullSetupResult, } from "./setup-actions.js";
+export { canLaunchBrowser, launchWebInstaller, launchWebDashboard, } from "./web/launch.js";
+export { startServer, type RunningServer } from "./web/server.js";
+export type { WebAppMode, BootstrapPayload } from "./web/types.js";
 export { runVersionCommand, collectVersionInfo, resolveBuildInfo, type BuildInfo, type VersionInfo, type VersionCommandOptions, } from "./version-cli.js";
-export { parseSetupArgs, readJsonFile, writeJsonFile, isOryHookCommand, resolveHookCommand, matcherHookEntry, mergeMatcherHooks, removeMatcherHooks, flatHookEntry, mergeFlatHooks, removeFlatHooks, printSetupHelp, printNextSteps, nextStepsSink, beginDeferNextSteps, emitDeferredNextSteps, resolveMcpServerCommand, mcpServerEntry, mergeMcpServer, removeMcpServer, registerPlugin, unregisterPlugin, type SetupArgs, type HookCommand, type MatcherEntry, } from "./setup.js";
+export { parseSetupArgs, readJsonFile, writeJsonFile, isOryHookCommand, resolveHookCommand, pinHookToLocalRegistry, matcherHookEntry, mergeMatcherHooks, removeMatcherHooks, flatHookEntry, mergeFlatHooks, removeFlatHooks, printSetupHelp, printNextSteps, nextStepsSink, beginDeferNextSteps, emitDeferredNextSteps, resolveMcpServerCommand, mcpServerEntry, mergeMcpServer, removeMcpServer, registerPlugin, unregisterPlugin, type SetupArgs, type HookCommand, type MatcherEntry, } from "./setup.js";
 export { runDevLauncher, type DevLauncherConfig, type InstallContext, } from "./dev.js";
 export { renderOrySkills, renderOryCommands, commandToSkill, commandToToml, commandToFrontmatterMarkdown, commandToPlainMarkdown, toSkillMarkdown, writeSkillTree, removeSkillDirs, ORY_SKILL_NAMES, ORY_COMMAND_SKILL_NAMES, ORY_COMMAND_SLUGS, type RenderedSkill, type RenderedCommand, type RenderProfileOptions, } from "./skills.js";
 export { runLocalCommand, ensureDevJaeger, stopDevJaeger, DEV_JAEGER_CONTAINER, type EnsureDevJaegerResult, type StopDevJaegerResult, } from "./local/index.js";
-export { runRegistryCommand } from "./registry/index.js";
+export { runRegistryCommand, REGISTRY_URL } from "./registry/index.js";
 export { checkAndDecide, applyPermissionMode, gateToolCall, type PermissionDecision, type ModeDecision, type DecisionSpanAttributes, type CheckAndDecideOptions, type ApplyPermissionModeContext, type GateToolCallArgs, type ToolGateOutcome, } from "./permissions.js";
 export { HARNESS_TOOL_CATALOG, KNOWN_HARNESSES, ALL_TOOLS, getToolCatalog, INTERACTIVE_TOOL_CATALOG, getInteractiveToolCatalog, isInteractiveTool, type KnownHarness, } from "./tool-catalog.js";
 export { classifyLifecycle, isUserFacingPhase, isToolExecutionPhase, HARNESS_LIFECYCLE_MAP, USER_FACING_PHASES, TOOL_EXECUTION_PHASES, type LifecyclePhase, } from "./lifecycle.js";
@@ -27,4 +32,6 @@ export { resolveUserSubject, runWithUserSubject, subjectLabel, type UserSubjectR
 export { formatDenialMessage, formatDenialSummary, formatAlertMessage, formatAlertSummary, alertAttributes, OryDenialError, type DenialContext, type AlertAttributes, } from "./denial.js";
 export { summarizeToolInput, summarizeToolOutput, type ToolInputSummary, type ToolOutputSummary, } from "./tool-metadata.js";
 export { OtlpExporter, otlpExporterFromEnv, parseKeyValueList, type SpanExporter, type OtlpExporterOptions, type OtlpProtocol, } from "./otel/index.js";
-export { resolveNamespace, sessionStart, gate, complete, registerSubagent, wrapTool, type SessionStartResult, type SessionStartOptions, type RegisterSubagentOptions, type GateResult, type GateOptions, type WrapToolOptions, } from "./adapters.js";
+export { resolveNamespace, sessionStart, gate, complete, registerSubagent, writeUserDelegatesAgent, writeAgentDelegatesSubagent, wrapTool, type SessionStartResult, type SessionStartOptions, type RegisterSubagentOptions, type GateResult, type GateOptions, type WrapToolOptions, } from "./adapters.js";
+export { collectSystemServices, type StatusSystemSection, type StatusSystemService, } from "./status-system.js";
+export { runDashboardCommand } from "./dashboard-cli.js";

package/dist/index.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.clearCredentialsForUninstall = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.withQuietStderr = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
-exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.LOOPBACK_REDIRECT_URIS = exports.projectUrlFromSlug = exports.runPostInstall = exports.runInteractiveSetup = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = void 0;
-exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = void 0;
-exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = void 0;
+exports.collectVersionInfo = exports.runVersionCommand = exports.startServer = exports.launchWebDashboard = exports.launchWebInstaller = exports.canLaunchBrowser = exports.configureLocalStack = exports.configureAuditOnly = exports.provisionProjectApiKey = exports.grantToolPermissions = exports.provisionPermissions = exports.inspectPermissions = exports.runFullSetup = exports.saveNetworkConfig = exports.provisionOAuth2Client = exports.enableDcrAction = exports.getDcrState = exports.resolveProjectUrl = exports.createProject = exports.createWorkspace = exports.listWorkspaces = exports.isSignedIn = exports.ensureOryCli = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.LOOPBACK_REDIRECT_URIS = exports.projectUrlFromSlug = exports.runPostInstall = exports.runInteractiveSetup = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = void 0;
+exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.pinHookToLocalRegistry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = void 0;
+exports.runDashboardCommand = exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -93,6 +93,33 @@ Object.defineProperty(exports, "runStatusCommand", { enumerable: true, get: func
 Object.defineProperty(exports, "printUserIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printUserIdentitySection; } });
 Object.defineProperty(exports, "printAgentIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printAgentIdentitySection; } });
 Object.defineProperty(exports, "printPermissionsSection", { enumerable: true, get: function () { return status_cli_js_1.printPermissionsSection; } });
+var status_data_js_1 = require("./status-data.js");
+Object.defineProperty(exports, "collectStatusReport", { enumerable: true, get: function () { return status_data_js_1.collectStatusReport; } });
+Object.defineProperty(exports, "probePermissionsCoverage", { enumerable: true, get: function () { return status_data_js_1.probePermissionsCoverage; } });
+var setup_actions_js_1 = require("./setup-actions.js");
+Object.defineProperty(exports, "ensureOryCli", { enumerable: true, get: function () { return setup_actions_js_1.ensureOryCli; } });
+Object.defineProperty(exports, "isSignedIn", { enumerable: true, get: function () { return setup_actions_js_1.isSignedIn; } });
+Object.defineProperty(exports, "listWorkspaces", { enumerable: true, get: function () { return setup_actions_js_1.listWorkspaces; } });
+Object.defineProperty(exports, "createWorkspace", { enumerable: true, get: function () { return setup_actions_js_1.createWorkspace; } });
+Object.defineProperty(exports, "createProject", { enumerable: true, get: function () { return setup_actions_js_1.createProject; } });
+Object.defineProperty(exports, "resolveProjectUrl", { enumerable: true, get: function () { return setup_actions_js_1.resolveProjectUrl; } });
+Object.defineProperty(exports, "getDcrState", { enumerable: true, get: function () { return setup_actions_js_1.getDcrState; } });
+Object.defineProperty(exports, "enableDcrAction", { enumerable: true, get: function () { return setup_actions_js_1.enableDcrAction; } });
+Object.defineProperty(exports, "provisionOAuth2Client", { enumerable: true, get: function () { return setup_actions_js_1.provisionOAuth2Client; } });
+Object.defineProperty(exports, "saveNetworkConfig", { enumerable: true, get: function () { return setup_actions_js_1.saveNetworkConfig; } });
+Object.defineProperty(exports, "runFullSetup", { enumerable: true, get: function () { return setup_actions_js_1.runFullSetup; } });
+Object.defineProperty(exports, "inspectPermissions", { enumerable: true, get: function () { return setup_actions_js_1.inspectPermissions; } });
+Object.defineProperty(exports, "provisionPermissions", { enumerable: true, get: function () { return setup_actions_js_1.provisionPermissions; } });
+Object.defineProperty(exports, "grantToolPermissions", { enumerable: true, get: function () { return setup_actions_js_1.grantToolPermissions; } });
+Object.defineProperty(exports, "provisionProjectApiKey", { enumerable: true, get: function () { return setup_actions_js_1.provisionProjectApiKey; } });
+Object.defineProperty(exports, "configureAuditOnly", { enumerable: true, get: function () { return setup_actions_js_1.configureAuditOnly; } });
+Object.defineProperty(exports, "configureLocalStack", { enumerable: true, get: function () { return setup_actions_js_1.configureLocalStack; } });
+var launch_js_1 = require("./web/launch.js");
+Object.defineProperty(exports, "canLaunchBrowser", { enumerable: true, get: function () { return launch_js_1.canLaunchBrowser; } });
+Object.defineProperty(exports, "launchWebInstaller", { enumerable: true, get: function () { return launch_js_1.launchWebInstaller; } });
+Object.defineProperty(exports, "launchWebDashboard", { enumerable: true, get: function () { return launch_js_1.launchWebDashboard; } });
+var server_js_1 = require("./web/server.js");
+Object.defineProperty(exports, "startServer", { enumerable: true, get: function () { return server_js_1.startServer; } });
 var version_cli_js_1 = require("./version-cli.js");
 Object.defineProperty(exports, "runVersionCommand", { enumerable: true, get: function () { return version_cli_js_1.runVersionCommand; } });
 Object.defineProperty(exports, "collectVersionInfo", { enumerable: true, get: function () { return version_cli_js_1.collectVersionInfo; } });
@@ -103,6 +130,7 @@ Object.defineProperty(exports, "readJsonFile", { enumerable: true, get: function
 Object.defineProperty(exports, "writeJsonFile", { enumerable: true, get: function () { return setup_js_1.writeJsonFile; } });
 Object.defineProperty(exports, "isOryHookCommand", { enumerable: true, get: function () { return setup_js_1.isOryHookCommand; } });
 Object.defineProperty(exports, "resolveHookCommand", { enumerable: true, get: function () { return setup_js_1.resolveHookCommand; } });
+Object.defineProperty(exports, "pinHookToLocalRegistry", { enumerable: true, get: function () { return setup_js_1.pinHookToLocalRegistry; } });
 Object.defineProperty(exports, "matcherHookEntry", { enumerable: true, get: function () { return setup_js_1.matcherHookEntry; } });
 Object.defineProperty(exports, "mergeMatcherHooks", { enumerable: true, get: function () { return setup_js_1.mergeMatcherHooks; } });
 Object.defineProperty(exports, "removeMatcherHooks", { enumerable: true, get: function () { return setup_js_1.removeMatcherHooks; } });
@@ -142,6 +170,7 @@ Object.defineProperty(exports, "stopDevJaeger", { enumerable: true, get: functio
 Object.defineProperty(exports, "DEV_JAEGER_CONTAINER", { enumerable: true, get: function () { return index_js_1.DEV_JAEGER_CONTAINER; } });
 var index_js_2 = require("./registry/index.js");
 Object.defineProperty(exports, "runRegistryCommand", { enumerable: true, get: function () { return index_js_2.runRegistryCommand; } });
+Object.defineProperty(exports, "REGISTRY_URL", { enumerable: true, get: function () { return index_js_2.REGISTRY_URL; } });
 var permissions_js_1 = require("./permissions.js");
 Object.defineProperty(exports, "checkAndDecide", { enumerable: true, get: function () { return permissions_js_1.checkAndDecide; } });
 Object.defineProperty(exports, "applyPermissionMode", { enumerable: true, get: function () { return permissions_js_1.applyPermissionMode; } });
@@ -190,4 +219,13 @@ Object.defineProperty(exports, "sessionStart", { enumerable: true, get: function
 Object.defineProperty(exports, "gate", { enumerable: true, get: function () { return adapters_js_1.gate; } });
 Object.defineProperty(exports, "complete", { enumerable: true, get: function () { return adapters_js_1.complete; } });
 Object.defineProperty(exports, "registerSubagent", { enumerable: true, get: function () { return adapters_js_1.registerSubagent; } });
+Object.defineProperty(exports, "writeUserDelegatesAgent", { enumerable: true, get: function () { return adapters_js_1.writeUserDelegatesAgent; } });
+Object.defineProperty(exports, "writeAgentDelegatesSubagent", { enumerable: true, get: function () { return adapters_js_1.writeAgentDelegatesSubagent; } });
 Object.defineProperty(exports, "wrapTool", { enumerable: true, get: function () { return adapters_js_1.wrapTool; } });
+// ─── Dashboard (status surface of the web app) ──────────────────────────────
+// Appended at EOF (outside the web-installer branch's edit region) so the two
+// branches merge without an index.ts conflict.
+var status_system_js_1 = require("./status-system.js");
+Object.defineProperty(exports, "collectSystemServices", { enumerable: true, get: function () { return status_system_js_1.collectSystemServices; } });
+var dashboard_cli_js_1 = require("./dashboard-cli.js");
+Object.defineProperty(exports, "runDashboardCommand", { enumerable: true, get: function () { return dashboard_cli_js_1.runDashboardCommand; } });