@ory/argus 0.13.8 → 0.14.0

package/dist/interactive-setup.js

@@ -15,10 +15,10 @@
  *      caller bootstrap permissions from the freshly-cached user identity.
  *
  * The whole wizard is **fail-open and skippable**: on a missing TTY, a
- * `--no-configure` flag, an already-configured plugin (without
- * `--reconfigure`), a missing `ory` CLI, or any `ory` failure it prints the
- * manual `configure` instructions and returns without throwing. Install must
- * never crash because setup was declined or the network was unreachable.
+ * `--no-configure` flag, a declined reconfigure prompt on an already-configured
+ * plugin, a missing `ory` CLI, or any `ory` failure it prints the manual
+ * `configure` instructions and returns without throwing. Install must never
+ * crash because setup was declined or the network was unreachable.
  *
  * The Ory Network integration deliberately reuses the official `ory` CLI
  * rather than re-implementing the Console API: the CLI already owns Network
@@ -65,10 +65,23 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ORY_CLI_NPM_SPEC = exports.LOOPBACK_REDIRECT_URIS = void 0;
 exports.createOryRunner = createOryRunner;
+exports.installOryCli = installOryCli;
 exports.runPostInstall = runPostInstall;
 exports.runInteractiveSetup = runInteractiveSetup;
+exports.inspectPermissionModel = inspectPermissionModel;
+exports.provisionPermissionModel = provisionPermissionModel;
+exports.oryCliPresent = oryCliPresent;
+exports.listProjects = listProjects;
+exports.dcrEnabled = dcrEnabled;
+exports.enableDcr = enableDcr;
+exports.projectLoginUiState = projectLoginUiState;
+exports.useManagedAccountExperience = useManagedAccountExperience;
+exports.findExistingOAuth2Client = findExistingOAuth2Client;
+exports.createOAuth2Client = createOAuth2Client;
+exports.parseList = parseList;
+exports.parseObject = parseObject;
 exports.projectUrlFromSlug = projectUrlFromSlug;
-exports.createProjectApiKeyViaConsole = createProjectApiKeyViaConsole;
+exports.isLocalProjectUrl = isLocalProjectUrl;
 exports.apiKeyAuthenticates = apiKeyAuthenticates;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
@@ -88,8 +101,12 @@ const agent_auth_js_1 = require("./agent-auth.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
 const index_js_1 = require("./local/index.js");
 const subject_js_1 = require("./subject.js");
+const branding_js_1 = require("./branding.js");
+const project_api_key_js_1 = require("./project-api-key.js");
 const permissions_cli_js_1 = require("./permissions-cli.js");
 const version_cli_js_1 = require("./version-cli.js");
+const launch_js_1 = require("./web/launch.js");
+const setup_actions_js_1 = require("./setup-actions.js");
 const ui = __importStar(require("./ui.js"));
 /** Loopback redirect URIs the PKCE user login expects on the OAuth2 client. */
 exports.LOOPBACK_REDIRECT_URIS = auth_js_1.LOOPBACK_PORTS.map((port) => `http://127.0.0.1:${port}/callback`);
@@ -101,6 +118,7 @@ exports.LOOPBACK_REDIRECT_URIS = auth_js_1.LOOPBACK_PORTS.map((port) => `http://
  */
 function createOryRunner(oryBin) {
     return {
+        bin: oryBin,
         exec(args, opts) {
             const r = (0, node_child_process_1.spawnSync)(oryBin, args, {
                 encoding: "utf-8",
@@ -153,6 +171,20 @@ async function installOryCli() {
     // Confirm the freshly installed binary actually runs before handing it back.
     return oryCliPresent(runner) ? runner : null;
 }
+/** Project the wizard's dep bag onto the subset the headless web actions use. */
+function toSetupDeps(deps) {
+    return {
+        runner: deps.runner,
+        installOryCliFn: deps.installOryCliFn,
+        clientFactory: deps.clientFactory,
+        userLoginFn: deps.userLoginFn,
+        agentGateFn: deps.agentGateFn,
+        localStackFn: deps.localStackFn,
+        seedFn: deps.seedFn,
+        createProjectApiKeyFn: deps.createProjectApiKeyFn,
+        validateApiKeyFn: deps.validateApiKeyFn,
+    };
+}
 /**
  * The shared post-install entry point every harness's `install` command
  * calls. Runs the interactive setup wizard, then (using whatever identity the
@@ -173,6 +205,35 @@ async function runPostInstall(binName, harness, args = [], deps = {}) {
     if (cliVersion !== "unknown") {
         ui.info(`${binName} v${cliVersion}`);
     }
+    // Prefer the local web installer when a browser is available and the user
+    // didn't opt out. It drives the same walkthrough (and writes its own
+    // permissions via the API), so on success we skip the TTY wizard and the
+    // DCR-token bootstrap, then print the closing onboarding help. Falls through
+    // to the terminal wizard when a browser can't be opened, `--no-web` /
+    // `--no-configure` is set, tests inject a prompt, or the launch fails.
+    //
+    // We always launch when a browser is available — even when Ory is already
+    // configured. The web app opens on its "current configuration" review
+    // screen and offers to reconfigure or keep the existing setup, so there's no
+    // separate `--reconfigure` gate here.
+    const noConfigure = args.includes("--no-configure");
+    const noWeb = args.includes("--no-web");
+    if (!noConfigure && !noWeb && !deps.promptFn && (0, launch_js_1.canLaunchBrowser)()) {
+        let launched = false;
+        try {
+            launched = await (0, launch_js_1.launchWebInstaller)(binName, harness, toSetupDeps(deps));
+        }
+        catch {
+            launched = false;
+        }
+        if (launched) {
+            // The web installer already walked the user through permissions in the
+            // browser, so skip the terminal permissions onboarding banner here and
+            // print only the closing next-steps summary.
+            (0, setup_js_1.emitDeferredNextSteps)(true);
+            return;
+        }
+    }
     const result = await runInteractiveSetup(binName, harness, args, deps);
     // The Ory Network wizard path bootstraps permissions itself (via the
     // admin-authenticated `ory` CLI). Only fall back to the DCR-token bootstrap
@@ -220,20 +281,6 @@ async function runInteractiveSetup(binName, harness, args = [], deps = {}) {
         printManualSetup(binName);
         return { outcome: "skipped_no_tty" };
     }
-    const resolved = (0, config_js_1.resolveConfig)();
-    if ((resolved.projectUrl || resolved.auditOnly) && !reconfigure) {
-        ui.banner("Ory Agent Plugin", "Already connected to Ory");
-        ui.blank();
-        ui.success("Ory is already configured for the agent plugins.");
-        ui.summary([
-            ["Mode", resolved.auditOnly ? "audit-only (no project)" : "connected"],
-            ["Project URL", resolved.auditOnly ? undefined : resolved.projectUrl],
-            ["Config", (0, config_js_1.getConfigPath)()],
-        ]);
-        ui.blank();
-        ui.hint(`Re-run with ${ui.inlineCommand("--reconfigure")} to change it.`);
-        return { outcome: "skipped_configured" };
-    }
     // The wizard prompts several times in a row. Opening `/dev/tty` afresh for
     // each prompt (as `promptOnTty` does) leaves a blocking read stuck in
     // libuv's threadpool per call, and after a few prompts the pool is
@@ -262,6 +309,39 @@ async function runInteractiveSetup(binName, harness, args = [], deps = {}) {
             ttyPrompter = createTtyPrompter();
         }
     };
+    // When Ory is already configured, always surface the current configuration
+    // first, then offer to reconfigure — a plain re-run of install shows what's
+    // set and asks, rather than silently no-oping. This replaces the old
+    // `--reconfigure` gate; the flag still works as a shortcut that skips the
+    // confirmation and drops straight into the wizard.
+    const resolved = (0, config_js_1.resolveConfig)();
+    if (resolved.projectUrl || resolved.auditOnly) {
+        ui.banner("Ory Agent Plugin", "Already connected to Ory");
+        ui.blank();
+        ui.success("Ory is already configured for the agent plugins.");
+        ui.summary([
+            [
+                "Mode",
+                resolved.auditOnly
+                    ? "audit-only (no project)"
+                    : isLocalProjectUrl(resolved.projectUrl)
+                        ? "local stack"
+                        : "connected",
+            ],
+            ["Project URL", resolved.auditOnly ? undefined : resolved.projectUrl],
+            ["Config", (0, config_js_1.getConfigPath)()],
+        ]);
+        ui.blank();
+        if (!reconfigure) {
+            const answer = await prompt(ui.promptLine("Reconfigure?", { hint: "[y/N]" }));
+            if (!isYes(answer)) {
+                ui.hint("Keeping the current configuration.");
+                ttyPrompter?.close();
+                return { outcome: "skipped_configured" };
+            }
+            ui.blank();
+        }
+    }
     // Quiet the structured stderr firehose for the duration of the wizard so
     // `[ory-agent] {...}` debug lines don't interleave with the human-facing UI
     // when a session runs with ORY_AGENT_DEBUG=true (the dev launcher always
@@ -369,7 +449,7 @@ function configureAuditOnly(binName) {
     ui.hint("Tool calls are traced locally; no Ory project, auth, or permission checks.");
     ui.summary([["Config", (0, config_js_1.getConfigPath)()]]);
     ui.blank();
-    ui.hint(`To connect to Ory later, re-run install with ${ui.inlineCommand("--reconfigure")}, or run:`);
+    ui.hint(`To connect to Ory later, re-run install, or run:`);
     ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --project-url <URL> --oauth2-client-id <CLIENT_ID>`);
     return { outcome: "audit_only" };
 }
@@ -415,7 +495,6 @@ async function configureLocalStack(binName, harness, ctx) {
         projectUrl: index_js_1.GATEWAY_URL,
         oauth2ClientId: index_js_1.USER_CLIENT_ID,
         userSubjectNamespace: index_js_1.USER_SUBJECT_NAMESPACE,
-        userLogin: true,
         auditOnly: false,
     });
     if (!running) {
@@ -458,7 +537,10 @@ async function configureLocalStack(binName, harness, ctx) {
             ["Password", credentials.password],
         ]);
     }
-    const { authenticated } = await completeFullSetup(binName, harness, ctx);
+    const { authenticated } = await completeFullSetup(binName, harness, ctx, {
+        projectUrl: index_js_1.GATEWAY_URL,
+        oauth2ClientId: index_js_1.USER_CLIENT_ID,
+    });
     return {
         outcome: "local_configured",
         projectUrl: index_js_1.GATEWAY_URL,
@@ -534,7 +616,7 @@ async function configureNetwork(binName, harness, ctx) {
     if (!workspaces || workspaces.length === 0) {
         console.warn("");
         ui.warning("No Ory Network workspace selected.");
-        ui.warnDetail("Create one at https://console.ory.sh/ and re-run install with --reconfigure.");
+        ui.warnDetail("Create one at https://console.ory.sh/ and re-run install.");
         printManualSetup(binName);
         return { outcome: "network_fallback" };
     }
@@ -569,23 +651,55 @@ async function configureNetwork(binName, harness, ctx) {
         return { outcome: "network_fallback" };
     }
     const projectUrl = projectUrlFromSlug(project.slug);
-    // 5. Enable OAuth2 Dynamic Client Registration so the agent identity can
-    //    self-register at runtime. Ory Network projects ship with DCR disabled,
-    //    so without this the default agent-identity path would never resolve.
-    await maybeEnableDcr(runner, prompt, project.id);
-    // 6. Provision the public OAuth2 client for the PKCE user login. Reuse an
-    //    existing one on this project first — a re-run (`install --reconfigure`)
-    //    against the same project must not mint a duplicate public client and
-    //    orphan the old one (the CLI-created client is never cleaned up by
-    //    uninstall). Only create when no prior client is found.
-    ui.heading("OAuth2 client");
+    // ── Set up the project ────────────────────────────────────────────────────
+    // Everything from here needs no decision from the user, so it runs as a
+    // single automated phase (mirroring the web installer's one "Set up" step):
+    // enable DCR, fix the login UI, provision the OAuth2 client, save, log in,
+    // grant permissions, and mint the project API key. Each action prints a
+    // one-line result; none of them prompt.
+    ui.heading("Setting up your project");
+    // Enable OAuth2 Dynamic Client Registration so the agent identity can
+    // self-register at runtime. Ory Network projects ship with DCR disabled, so
+    // without this the default agent-identity path would never resolve — it's
+    // required, so we enable it silently rather than asking.
+    const dcr = dcrEnabled(runner, project.id);
+    if (dcr === true) {
+        ui.success("Dynamic Client Registration already enabled.");
+    }
+    else if (enableDcr(runner, project.id)) {
+        ui.success("Enabled Dynamic Client Registration.");
+    }
+    else {
+        ui.warning("Could not enable Dynamic Client Registration automatically.");
+        ui.warnDetail(`Enable it later: ory patch oauth2-config --project ${project.id} --replace '${DCR_ENABLED_PATH}=true'`);
+        ui.warnDetail("or supply static agent credentials (ORY_AGENT_CLIENT_ID + ORY_AGENT_CLIENT_SECRET).");
+    }
+    // Make sure the browser-login UI is the Ory Managed Account Experience. A
+    // CLI-created project defaults the Kratos self-service and OAuth2
+    // login/consent URLs to the localhost:3000 quickstart sample, so the PKCE
+    // user login below would redirect the browser to a page nothing is serving.
+    // Best-effort; never clobbers a deliberate custom UI.
+    const loginUi = projectLoginUiState(runner, project.id);
+    if (loginUi === "loopback") {
+        useManagedAccountExperience(runner, project.id);
+        ui.success("Switched the login UI to the Ory Account Experience.");
+    }
+    else if (loginUi === "custom_external") {
+        ui.hint("This project uses a custom login UI; the browser login will use it.");
+    }
+    // Provision the public OAuth2 client for the PKCE user login. Reuse an
+    // existing one on this project first — a re-run (`install --reconfigure`)
+    // against the same project must not mint a duplicate public client and orphan
+    // the old one (the CLI-created client is never cleaned up by uninstall). Only
+    // create when no prior client is found.
     let clientId = findExistingOAuth2Client(runner, project.id);
     if (clientId) {
-        ui.step(`Reusing the existing OAuth2 client for user login (${clientId}).`);
+        ui.success(`Reusing the OAuth2 client for user login (${clientId}).`);
     }
     else {
-        ui.step("Creating the OAuth2 client for user login...");
         clientId = createOAuth2Client(runner, project.id);
+        if (clientId)
+            ui.success("Created the OAuth2 client for user login.");
     }
     if (!clientId) {
         ui.warning("Could not create the OAuth2 client automatically.");
@@ -595,29 +709,33 @@ async function configureNetwork(binName, harness, ctx) {
         (0, config_js_1.saveConfig)({ projectUrl, projectId: project.id, auditOnly: false });
         return { outcome: "network_fallback", projectUrl };
     }
-    // 7. Persist and enable user login. The project id is stored alongside the
-    //    URL (it's the `ORY_PROJECT_ID` value) so later admin operations and
-    //    `status` have it without re-selecting a project.
+    // Persist the connection. The project id is stored alongside the URL (it's
+    // the `ORY_PROJECT_ID` value) so later admin operations and `status` have it
+    // without re-selecting a project.
     (0, config_js_1.saveConfig)({
         projectUrl,
         projectId: project.id,
+        projectName: project.name ?? project.slug,
+        workspaceName: workspace.name,
         oauth2ClientId: clientId,
-        userLogin: true,
         auditOnly: false,
     });
-    ui.heading("Ory Network connected:");
-    ui.success("Project connected and OAuth2 client created.");
+    ui.success("Saved the Ory Network connection.");
     ui.summary([
         ["Project URL", projectUrl],
         ["OAuth2 client id", clientId],
         ["Config", (0, config_js_1.getConfigPath)()],
     ]);
-    // 8. Best-effort full setup: log the user in now and resolve the agent
-    //    identity, so the very next session is fully wired.
-    const { authenticated, subject } = await completeFullSetup(binName, harness, ctx);
-    // 9. Bootstrap permissions via the admin-authenticated `ory` CLI. The
-    //    runtime agent/user tokens can't write relation tuples on a hosted
-    //    project (that's a project-admin operation), but the `ory` session can.
+    // Log the user in now and resolve the agent identity, so the very next
+    // session is fully wired.
+    const { authenticated, subject } = await completeFullSetup(binName, harness, ctx, {
+        projectUrl,
+        oauth2ClientId: clientId,
+    });
+    // Grant permissions via the admin-authenticated `ory` CLI. The runtime
+    // agent/user tokens can't write relation tuples on a hosted project (that's a
+    // project-admin operation), but the `ory` session can. The permission model
+    // is provisioned automatically if the project doesn't define the namespace.
     if (subject) {
         // Persist the subject *shape* this grant used. If the install resolved a
         // SubjectSet (ORY_USER_SUBJECT_NAMESPACE was set), a later runtime session
@@ -627,14 +745,13 @@ async function configureNetwork(binName, harness, ctx) {
         if ("subjectSet" in subject) {
             (0, config_js_1.saveConfig)({ userSubjectNamespace: subject.subjectSet.namespace });
         }
-        await bootstrapPermissionsViaOry(runner, project.id, harness, subject, prompt);
-    }
-    // 10. Provision the project API key runtime permission *checks* need. Same
-    //     root cause as bootstrap's admin path — the DCR OAuth2 token can't
-    //     authenticate Ory Network's Permission API — but this credential is used
-    //     at runtime, so it's persisted to config. Placed last so its prompt
-    //     doesn't consume answers meant for earlier steps.
-    await maybeProvisionProjectApiKey(binName, harness, project.id, projectUrl, prompt, ctx.deps.createProjectApiKeyFn ?? createProjectApiKeyViaConsole, ctx.deps.validateApiKeyFn ?? apiKeyAuthenticates);
+        await bootstrapPermissionsViaOry(runner, project.id, harness, subject);
+    }
+    // Provision the project API key runtime permission *checks* need. Same root
+    // cause as the bootstrap's admin path — the DCR OAuth2 token can't
+    // authenticate Ory Network's Permission API — but this credential is used at
+    // runtime, so it's persisted to config. Minted automatically (no prompt).
+    await maybeProvisionProjectApiKey(binName, project.id, projectUrl, ctx.deps.createProjectApiKeyFn ?? project_api_key_js_1.createProjectApiKeyViaConsole, ctx.deps.validateApiKeyFn ?? apiKeyAuthenticates, subject ? (0, setup_actions_js_1.resourceUserLabel)(runner, project.id, subject) : undefined);
     return {
         outcome: "network_configured",
         projectUrl,
@@ -645,10 +762,17 @@ async function configureNetwork(binName, harness, ctx) {
         skipAutoBootstrap: true,
     };
 }
-async function completeFullSetup(binName, harness, ctx) {
+async function completeFullSetup(binName, harness, ctx, target = {}) {
     const clientFactory = ctx.deps.clientFactory ?? client_js_1.OryAgentClient.fromEnv;
     const userLogin = ctx.deps.userLoginFn ?? user_login_js_1.ensureUserAuthenticated;
     const agentGate = ctx.deps.agentGateFn ?? agent_auth_js_1.ensureAgentIdentity;
+    // Pin the project the wizard just selected so a stale ORY_PROJECT_URL /
+    // ORY_SDK_URL / ORY_OAUTH2_CLIENT_ID in the user's shell can't override it and
+    // launch the login at the wrong URL (the login gate resolves these env-first).
+    // Scoped to the login call and restored after: the later install steps
+    // address the project by id (CLI `--project`) rather than the env, so the
+    // pin only needs to hold for the browser login.
+    const restoreEnv = pinProjectEnv(target);
     try {
         const client = clientFactory(harness);
         ui.heading("Signing you in to the project as the permission subject.");
@@ -656,7 +780,6 @@ async function completeFullSetup(binName, harness, ctx) {
         const decision = await userLogin(client, {
             binName,
             harness,
-            allowBlock: false,
         });
         // Resolve the agent identity regardless — it bootstraps from the user
         // token when present and no-ops otherwise. Never blocks.
@@ -673,6 +796,32 @@ async function completeFullSetup(binName, harness, ctx) {
         ui.warning(`Skipping automatic login (will run on first session): ${msg}`);
         return { authenticated: false, subject: null };
     }
+    finally {
+        restoreEnv();
+    }
+}
+/**
+ * Set ORY_PROJECT_URL / ORY_OAUTH2_CLIENT_ID to the wizard-selected values and
+ * return a function that restores their prior values. Used to pin the browser
+ * login to the just-selected project without leaking the override past it.
+ */
+function pinProjectEnv(target) {
+    const prevUrl = process.env.ORY_PROJECT_URL;
+    const prevClient = process.env.ORY_OAUTH2_CLIENT_ID;
+    if (target.projectUrl)
+        process.env.ORY_PROJECT_URL = target.projectUrl;
+    if (target.oauth2ClientId)
+        process.env.ORY_OAUTH2_CLIENT_ID = target.oauth2ClientId;
+    return () => {
+        if (prevUrl === undefined)
+            delete process.env.ORY_PROJECT_URL;
+        else
+            process.env.ORY_PROJECT_URL = prevUrl;
+        if (prevClient === undefined)
+            delete process.env.ORY_OAUTH2_CLIENT_ID;
+        else
+            process.env.ORY_OAUTH2_CLIENT_ID = prevClient;
+    };
 }
 /**
  * Grant the signed-in user `use` on every built-in tool by writing relation
@@ -703,31 +852,22 @@ async function completeFullSetup(binName, harness, ctx) {
  * than a wall of errors. Observe mode (the install default) keeps tools working
  * regardless, so this is an optimization, not a hard requirement.
  */
-async function bootstrapPermissionsViaOry(runner, projectId, harness, subject, prompt) {
+async function bootstrapPermissionsViaOry(runner, projectId, harness, subject) {
     const namespace = process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
     const tools = (0, tool_catalog_js_1.getToolCatalog)(harness);
     if (tools.length === 0)
         return;
     // Ensure the namespace the tuples reference exists, or the write NotFounds.
     // We only skip provisioning when the namespace is already defined; every
-    // other state provisions. When we can fetch the existing OPL source we merge
-    // our namespace into it (non-destructive); otherwise we create a fresh
-    // minimal model. The one case we refuse is a model that provably exists but
-    // whose source we couldn't read — overwriting it would clobber it.
+    // other state provisions automatically (no prompt). When we can fetch the
+    // existing OPL source we merge our namespace into it (non-destructive);
+    // otherwise we create a fresh minimal model. The one case we refuse is a
+    // model that provably exists but whose source we couldn't read — overwriting
+    // it would clobber it.
     const model = await inspectPermissionModel(runner, projectId, namespace);
     if (model.kind === "merge") {
         // A model exists and we have its OPL source — append our namespace without
-        // disturbing the others (prompted).
-        ui.heading(`This project has a permission model, but it doesn't define '${namespace}'.`);
-        ui.hint("It can be added to the existing model without changing the other namespaces.");
-        ui.blank();
-        const answer = await prompt(ui.promptLine(`Add '${namespace}' to this project's permission model now?`, {
-            hint: "[Y/n]",
-        }));
-        if (isNo(answer)) {
-            printPermissionModelHelp(namespace);
-            return;
-        }
+        // disturbing the others.
         if (!provisionPermissionModel(runner, projectId, namespace, model.opl)) {
             ui.warning(`Could not add '${namespace}' to the permission model automatically.`);
             printPermissionModelHelp(namespace);
@@ -736,16 +876,8 @@ async function bootstrapPermissionsViaOry(runner, projectId, harness, subject, p
         ui.success(`Added '${namespace}' to the permission model.`);
     }
     else if (model.kind === "empty" || model.kind === "unknown") {
-        // No model (or one we couldn't read at all) — provision a minimal one
-        // (prompted). Reading the config failing is treated as "nothing there".
-        ui.heading(`This project has no '${namespace}' permission model yet —`);
-        ui.hint("without it, permission checks can't be granted or enforced.");
-        ui.blank();
-        const answer = await prompt(ui.promptLine(`Create a minimal '${namespace}' permission model on this project now?`, { hint: "[Y/n]" }));
-        if (isNo(answer)) {
-            printPermissionModelHelp(namespace);
-            return;
-        }
+        // No model (or one we couldn't read at all) — provision a minimal one.
+        // Reading the config failing is treated as "nothing there".
         if (!provisionPermissionModel(runner, projectId, namespace)) {
             ui.warning(`Could not create the '${namespace}' permission model automatically.`);
             printPermissionModelHelp(namespace);
@@ -756,8 +888,7 @@ async function bootstrapPermissionsViaOry(runner, projectId, harness, subject, p
     else if (model.kind === "blocked") {
         // A model provably exists but we couldn't fetch its source, so we can't
         // merge and `ory update opl` would overwrite it. Guide instead of clobber.
-        ui.heading(`This project has a permission model, but it doesn't define '${namespace}'`);
-        ui.hint("and its source couldn't be read, so adding it automatically might overwrite it.");
+        ui.warning(`This project's permission model couldn't be read; '${namespace}' wasn't added.`);
         printPermissionModelHelp(namespace);
         return;
     }
@@ -777,7 +908,6 @@ async function bootstrapPermissionsViaOry(runner, projectId, harness, subject, p
         relation: "use",
         ...subjectPatch,
     }));
-    ui.heading("Permissions");
     ui.step(`Granting ${(0, subject_js_1.subjectLabel)(subject)} 'use' on ${tools.length} tools (via the Ory CLI)...`);
     const r = runner.exec(["create", "relationships", "--project", projectId, "--format", "json", "-f", "-", "--yes"], { input: JSON.stringify(tuples) });
     if (r.status === 0) {
@@ -960,12 +1090,12 @@ function printPermissionModelHelp(namespace) {
         console.warn(ui.style.gray("      }"));
         console.warn("");
         ui.warnDetail("(drop the `User` class if your model already defines it), then re-run");
-        ui.warnDetail("install with --reconfigure to grant. You're in observe mode, so tools");
-        ui.warnDetail("keep working meanwhile.");
+        ui.warnDetail("install to grant. You're in observe mode, so tools keep working");
+        ui.warnDetail("meanwhile.");
         return;
     }
     ui.warnDetail(`Define the '${namespace}' namespace in Ory Permissions, then re-run install`);
-    ui.warnDetail("with --reconfigure to grant. You're in observe mode, so tools keep working.");
+    ui.warnDetail("to grant. You're in observe mode, so tools keep working.");
 }
 // ─── ory CLI helpers ──────────────────────────────────────────────────────
 function oryCliPresent(runner) {
@@ -1099,7 +1229,7 @@ async function selectOrCreateProject(runner, prompt, workspace, harness, project
  * project" menu option. Returns null on failure.
  */
 async function createProjectInteractive(runner, prompt, workspace, harness) {
-    const defaultName = `${harness}-agent`;
+    const defaultName = branding_js_1.DEFAULT_PROJECT_NAME;
     const nameInput = await prompt(ui.promptLine("New project name", { hint: `[${defaultName}]` }));
     const name = nameInput && nameInput.length > 0 ? nameInput : defaultName;
     const r = runner.exec([
@@ -1149,27 +1279,11 @@ function dcrEnabled(runner, projectId) {
     return typeof enabled === "boolean" ? enabled : null;
 }
 /**
- * Enable OAuth2 Dynamic Client Registration on the project so the agent
- * identity can self-register (RFC 7591) at runtime. First probes the project's
- * current DCR state and skips silently when it's already enabled. Otherwise
- * prompts (default yes) since it changes project-wide config; best-effort and
- * fail-open — a decline or failure just prints the manual command and continues.
+ * Patch the project's oauth2-config to enable Dynamic Client Registration.
+ * Prompt-free; returns true on success. Shared by the TTY wizard's
+ * {@link maybeEnableDcr} and the web installer API.
  */
-async function maybeEnableDcr(runner, prompt, projectId) {
-    if (dcrEnabled(runner, projectId) === true)
-        return;
-    ui.heading("Dynamic Client Registration");
-    ui.info("The agent identity registers itself via OAuth2 Dynamic Client Registration");
-    ui.hint("(DCR), which Ory Network projects disable by default.");
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Enable Dynamic Client Registration on this project?", { hint: "[Y/n]" }));
-    const manual = `ory patch oauth2-config --project ${projectId} --replace '${DCR_ENABLED_PATH}=true'`;
-    if (isNo(answer)) {
-        ui.hint("Skipped. Enable it later with:");
-        ui.command(manual);
-        ui.hint("or supply static agent credentials (ORY_AGENT_CLIENT_ID + ORY_AGENT_CLIENT_SECRET).");
-        return;
-    }
+function enableDcr(runner, projectId) {
     const r = runner.exec([
         "patch",
         "oauth2-config",
@@ -1181,21 +1295,138 @@ async function maybeEnableDcr(runner, prompt, projectId) {
         "json",
         "--yes",
     ]);
-    if (r.status === 0) {
-        ui.success("Dynamic Client Registration enabled.");
+    return r.status === 0;
+}
+/** Read the OAuth2 (Hydra) login/consent/logout/registration provider URLs. */
+function readOauth2UiUrls(runner, projectId) {
+    const r = runner.exec(["get", "oauth2-config", "--project", projectId, "--format", "json"]);
+    if (r.status !== 0)
+        return null;
+    const config = parseObject(r.stdout);
+    if (!config)
+        return null;
+    const urls = config.urls ?? {};
+    const out = [];
+    for (const key of ["login", "consent", "logout", "registration"]) {
+        const u = urls[key];
+        if (typeof u === "string" && u.trim())
+            out.push({ path: `/urls/${key}`, url: u.trim() });
+    }
+    return out;
+}
+/** Read the Kratos self-service flow UI URLs (where the browser login lands). */
+function readIdentityUiUrls(runner, projectId) {
+    const r = runner.exec(["get", "identity-config", "--project", projectId, "--format", "json"]);
+    if (r.status !== 0)
+        return null;
+    const config = parseObject(r.stdout);
+    if (!config)
+        return null;
+    const flows = config.selfservice?.flows ?? {};
+    const out = [];
+    for (const flow of ["login", "registration", "settings", "recovery", "verification", "error"]) {
+        const u = flows[flow]?.ui_url;
+        if (typeof u === "string" && u.trim())
+            out.push({ path: `/selfservice/flows/${flow}/ui_url`, url: u.trim() });
+    }
+    return out;
+}
+/**
+ * Classify a single UI URL:
+ *  - `managed` — a relative path (`/ui/login`) or an `oryapis`/`ory.sh` host:
+ *    the Ory Managed Account Experience, which works for a hosted project.
+ *  - `loopback` — a `localhost`/`127.0.0.1` host: Ory's quickstart sample,
+ *    reachable only on the machine that ran it, so the hosted login dies here.
+ *  - `custom` — any other absolute URL: a deliberate custom UI; leave it alone.
+ */
+function classifyUiUrl(url) {
+    const u = url.trim();
+    if (!u || u.startsWith("/"))
+        return "managed";
+    let host;
+    try {
+        host = new URL(u).hostname;
     }
-    else {
-        ui.warning(`Could not enable DCR automatically: ${r.stderr.trim() || "unknown error"}`);
-        ui.warnDetail(`Enable it later with: ${manual}`);
+    catch {
+        return "managed"; // unparseable — don't touch it
     }
+    if (host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1")
+        return "loopback";
+    if (host === "oryapis.com" || host.endsWith(".oryapis.com") || host.endsWith(".ory.sh"))
+        return "managed";
+    return "custom";
+}
+/**
+ * Classify the project's browser-login UI across the identity-config
+ * (self-service) and oauth2-config (login/consent) URLs:
+ *  - `loopback` — at least one URL points at a `localhost` sample (needs fixing).
+ *  - `custom_external` — a deliberate custom UI is set and none are loopback.
+ *  - `managed` — everything is empty / relative / on the managed AX.
+ *  - `unknown` — neither config could be read.
+ */
+function projectLoginUiState(runner, projectId) {
+    const oauth2 = readOauth2UiUrls(runner, projectId);
+    const identity = readIdentityUiUrls(runner, projectId);
+    if (oauth2 === null && identity === null)
+        return "unknown";
+    const entries = [...(oauth2 ?? []), ...(identity ?? [])];
+    const kinds = entries.map((e) => classifyUiUrl(e.url));
+    if (kinds.includes("loopback"))
+        return "loopback";
+    if (kinds.includes("custom"))
+        return "custom_external";
+    return "managed";
+}
+/** Clear the loopback UI URLs in one config so it falls back to the managed AX. */
+function clearLoopbackUiUrls(runner, projectId, config, entries) {
+    if (entries === null)
+        return true; // couldn't read → nothing to clear (best-effort)
+    const ops = [];
+    for (const e of entries) {
+        if (classifyUiUrl(e.url) === "loopback")
+            ops.push("--replace", `${e.path}=`);
+    }
+    if (ops.length === 0)
+        return true;
+    const r = runner.exec([
+        "patch",
+        config,
+        "--project",
+        projectId,
+        ...ops,
+        "--format",
+        "json",
+        "--yes",
+    ]);
+    return r.status === 0;
 }
-/** The `client_name` every plugin-provisioned public PKCE client carries. */
-const OAUTH2_CLIENT_NAME = "ory-agent-plugin";
+/**
+ * Point the project's browser-login UI at the Ory Managed Account Experience by
+ * clearing any loopback (localhost sample) URLs in *both* the identity-config
+ * (self-service flows) and the oauth2-config (login/consent). Clearing a UI URL
+ * makes Ory Network fall back to the managed AX. Best-effort; returns true when
+ * the patches succeeded (or there was nothing to clear). Never touches a
+ * deliberate non-loopback custom UI.
+ */
+function useManagedAccountExperience(runner, projectId) {
+    const oauth2Ok = clearLoopbackUiUrls(runner, projectId, "oauth2-config", readOauth2UiUrls(runner, projectId));
+    const identityOk = clearLoopbackUiUrls(runner, projectId, "identity-config", readIdentityUiUrls(runner, projectId));
+    return oauth2Ok && identityOk;
+}
+/**
+ * Enable OAuth2 Dynamic Client Registration on the project so the agent
+ * identity can self-register (RFC 7591) at runtime. First probes the project's
+ * current DCR state and skips silently when it's already enabled. Otherwise
+ * prompts (default yes) since it changes project-wide config; best-effort and
+ * fail-open — a decline or failure just prints the manual command and continues.
+ */
 /**
  * Look for an already-provisioned public PKCE client on the project so a
- * re-run reuses it instead of minting a duplicate. Matches by the fixed
- * `client_name` {@link createOAuth2Client} assigns. Best-effort: any CLI or
- * parse failure returns null and the caller falls back to creating one.
+ * re-run — or another user installing against the same shared project — reuses
+ * the one client instead of minting a duplicate. Matches the current
+ * {@link USER_LOGIN_CLIENT_NAME} *and* any legacy name an older install may
+ * have used, so a rename never orphans a still-valid client. Best-effort: any
+ * CLI or parse failure returns null and the caller falls back to creating one.
  */
 function findExistingOAuth2Client(runner, projectId) {
     const r = runner.exec([
@@ -1211,7 +1442,7 @@ function findExistingOAuth2Client(runner, projectId) {
     const clients = parseList(r.stdout, "items");
     if (!clients)
         return null;
-    const match = clients.find((c) => c.client_name === OAUTH2_CLIENT_NAME && c.client_id);
+    const match = clients.find((c) => c.client_id && c.client_name && branding_js_1.USER_LOGIN_CLIENT_NAMES.includes(c.client_name));
     return match?.client_id ?? null;
 }
 function createOAuth2Client(runner, projectId) {
@@ -1221,7 +1452,7 @@ function createOAuth2Client(runner, projectId) {
         "--project",
         projectId,
         "--name",
-        OAUTH2_CLIENT_NAME,
+        branding_js_1.USER_LOGIN_CLIENT_NAME,
         "--grant-type",
         "authorization_code,refresh_token",
         "--response-type",
@@ -1336,10 +1567,33 @@ function isNo(answer) {
     const v = answer.trim().toLowerCase();
     return v === "n" || v === "no";
 }
+/** Yes only on an explicit y/yes; empty / null / anything else is No. */
+function isYes(answer) {
+    if (answer === null)
+        return false;
+    const v = answer.trim().toLowerCase();
+    return v === "y" || v === "yes";
+}
+/**
+ * A project URL on a loopback host is the self-hosted local stack (the dev
+ * launcher's gateway on localhost), not a hosted Ory Network project — so the
+ * "Mode" summary should read "local stack" for it.
+ */
+function isLocalProjectUrl(url) {
+    if (!url)
+        return false;
+    try {
+        const host = new URL(url).hostname;
+        return host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1";
+    }
+    catch {
+        return false;
+    }
+}
 // ─── banners ────────────────────────────────────────────────────────────────
 function printOryCliMissing() {
     ui.heading("The Ory CLI (`ory`) is required to connect to Ory Network but was not found.");
-    ui.hint("Install it, then re-run install with --reconfigure:");
+    ui.hint("Install it, then re-run install:");
     ui.summary([
         ["macOS/Linux (Homebrew)", "brew install ory/tap/cli"],
         [
@@ -1364,7 +1618,7 @@ function printManualOAuth2ClientHelp(binName, projectId) {
     ui.heading("Create the public OAuth2 client by hand, then supply its id:");
     ui.blank();
     console.log(ui.style.gray(`  ory create oauth2-client --project ${projectId} \\`));
-    console.log(ui.style.gray(`    --name "ory-agent-plugin" \\`));
+    console.log(ui.style.gray(`    --name "${branding_js_1.USER_LOGIN_CLIENT_NAME}" \\`));
     console.log(ui.style.gray(`    --grant-type authorization_code,refresh_token \\`));
     console.log(ui.style.gray(`    --response-type code \\`));
     console.log(ui.style.gray(`    --scope openid,offline_access \\`));
@@ -1376,68 +1630,6 @@ function printManualOAuth2ClientHelp(binName, projectId) {
     ui.blank();
     ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --oauth2-client-id <CLIENT_ID>`);
 }
-/** Ory Console API base. The `ory` CLI has no project-API-key command, so key
- *  provisioning talks to the Console API directly, authenticated with the CLI's
- *  stored Ory Network session. Override with `ORY_CONSOLE_API_URL`. */
-const CONSOLE_API_URL = process.env.ORY_CONSOLE_API_URL?.trim() || "https://api.console.ory.sh";
-/** Path to the session the `ory` CLI persists after `ory auth`. */
-const ORY_CLI_SESSION_FILE = ".ory-cloud.json";
-/**
- * Read the Ory Network session bearer the `ory` CLI stores at
- * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
- * no token, or the token has expired. Never throws.
- */
-function readConsoleSessionToken() {
-    try {
-        const raw = fs.readFileSync(path.join(os.homedir(), ORY_CLI_SESSION_FILE), "utf-8");
-        const parsed = JSON.parse(raw);
-        const token = parsed.access_token?.access_token;
-        if (!token)
-            return null;
-        const expiry = parsed.access_token?.expiry;
-        if (expiry) {
-            const expMs = Date.parse(expiry);
-            if (Number.isFinite(expMs) && expMs <= Date.now())
-                return null;
-        }
-        return token;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Mint an Ory Network **project API key** via the Console API
- * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
- * Returns the `ory_pat_…` value, or null on any failure (no session, non-2xx,
- * missing value). Never throws — provisioning is best-effort.
- *
- * This is the one place the wizard reaches past the `ory` CLI to the Console
- * API: the CLI (as of v1.3) exposes no project-API-key command, and Keto
- * permission checks can't authenticate without one.
- */
-async function createProjectApiKeyViaConsole(args) {
-    const token = readConsoleSessionToken();
-    if (!token)
-        return null;
-    try {
-        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({ name: args.name }),
-        });
-        if (!res.ok)
-            return null;
-        const body = (await res.json());
-        return typeof body.value === "string" && body.value.length > 0 ? body.value : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Best-effort check that an already-stored project API key still authenticates
  * against Keto. Runs one permission check with the key: if it completes (any
@@ -1488,7 +1680,7 @@ function printManualApiKeySteps(binName, projectId) {
  * TTY / any failure falls back to manual guidance. No-ops when a key is already
  * configured (env or config file).
  */
-async function maybeProvisionProjectApiKey(binName, harness, projectId, projectUrl, prompt, createFn, validateFn) {
+async function maybeProvisionProjectApiKey(binName, projectId, projectUrl, createFn, validateFn, userLabel) {
     const resolved = (0, config_js_1.resolveConfig)();
     if (resolved.apiKey) {
         // An operator-set env key is authoritative — never touch it.
@@ -1498,49 +1690,45 @@ async function maybeProvisionProjectApiKey(binName, harness, projectId, projectU
         // deleted — must not wedge setup: validate it and re-provision if it's
         // dead. Presence alone isn't enough (a dangling key still fails at runtime
         // with session_inactive).
-        if (await validateFn(resolved.apiKey, projectUrl))
+        if (await validateFn(resolved.apiKey, projectUrl)) {
+            ui.success("Stored project API key is valid.");
             return;
-        ui.heading("Project API key");
-        ui.warning("The stored project API key is no longer valid (revoked or deleted).");
-    }
-    else {
-        ui.heading("Project API key");
-        ui.info("Runtime permission checks call Ory's Permission API, which authenticates");
-        ui.hint("with a project API key — the agent's OAuth2 token isn't accepted there.");
-        ui.hint("(Observe mode works without it; enforce mode needs it to allow tools.)");
-    }
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Create a project API key now and store it?", { hint: "[Y/n]" }));
-    // `null` = no TTY / cancelled; treat as skip so we never mint without consent.
-    if (answer !== null && !isNo(answer)) {
-        ui.step("Creating a project API key via the Ory Console…");
-        let key = null;
+        }
+        ui.warning("The stored project API key is no longer valid (revoked or deleted) — replacing it.");
+    }
+    // Runtime permission checks call Ory's Permission API, which authenticates
+    // with a project API key (the agent's OAuth2 token isn't accepted there), so
+    // one is minted automatically. Observe mode works without it; enforce mode
+    // needs it to allow tools.
+    ui.step("Creating a project API key via the Ory Console…");
+    let created = null;
+    try {
+        // Name the key for the signed-in user + host so that, on a shared project
+        // where every user mints their own, a team admin can tell whose key is
+        // whose and prune stale ones. The Console's "Date Added" column already
+        // shows when each key was created, so no timestamp in the name.
+        let host = "unknown-host";
         try {
-            // Name each key uniquely (harness + host + timestamp) so keys are
-            // distinguishable in the Console and a re-provision never collides with
-            // an existing entry.
-            key = await createFn({ projectId, name: projectApiKeyName(harness) });
+            host = os.hostname();
         }
         catch {
-            key = null;
-        }
-        if (key) {
-            (0, config_js_1.saveConfig)({ apiKey: key });
-            ui.success("Project API key created and stored — permission checks will use it.");
-            return;
+            /* keep fallback */
         }
-        ui.warning("Couldn't create a project API key automatically (Console session may be missing or expired).");
-    }
-    printManualApiKeySteps(binName, projectId);
-}
-/** Distinguishable, collision-free label for a provisioned project API key. */
-function projectApiKeyName(harness) {
-    let host = "unknown-host";
-    try {
-        host = os.hostname();
+        created = await createFn({
+            projectId,
+            name: (0, branding_js_1.projectApiKeyName)({ host, user: userLabel }),
+        });
     }
     catch {
-        /* keep fallback */
+        created = null;
     }
-    return `ory-agent-plugins ${harness} ${host} ${new Date().toISOString()}`;
+    if (created) {
+        // Persist the token id alongside the secret so uninstall can delete the key
+        // server-side (deletion addresses the token by id, not by its secret value).
+        (0, config_js_1.saveConfig)({ apiKey: created.value, apiKeyId: created.id ?? null });
+        ui.success("Project API key created and stored — permission checks will use it.");
+        return;
+    }
+    ui.warning("Couldn't create a project API key automatically (Console session may be missing or expired).");
+    printManualApiKeySteps(binName, projectId);
 }