@ory/argus 0.13.8 → 0.14.0

package/dist/local/health.d.ts

@@ -19,6 +19,20 @@ export declare function checkAllServices(options?: {
     projectRoot?: string;
     gatewayUrl?: string;
 }): Promise<ServiceHealth[]>;
+/**
+ * Wait until every backend service the seed writes to reports ready, polling
+ * at the given interval. Returns `{ ready: true }` on success, or
+ * `{ ready: false, pending }` listing the services that never came up within
+ * the timeout.
+ *
+ * Call this before seeding: it closes the race where the gateway is green and
+ * containers are "running" but Kratos / Keto / Hydra are not yet serving on
+ * their admin/write ports.
+ */
+export declare function waitForSeedTargets(timeoutMs?: number, intervalMs?: number): Promise<{
+    ready: boolean;
+    pending: string[];
+}>;
 /**
  * Wait for the gateway to become healthy, polling at the given interval.
  * Returns true if healthy within the timeout, false otherwise.

package/dist/local/health.js

@@ -4,6 +4,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkAllServices = checkAllServices;
+exports.waitForSeedTargets = waitForSeedTargets;
 exports.waitForGateway = waitForGateway;
 const configs_js_1 = require("./configs.js");
 async function checkEndpoint(name, url) {
@@ -38,6 +39,51 @@ async function checkAllServices(options = {}) {
     ];
     return Promise.all(checks);
 }
+/**
+ * Backend services the seed writes to, addressed at the exact host-published
+ * ports the seed uses (Kratos **admin**, Keto **write**, Hydra **admin**), so
+ * a green result means the seed's target APIs are actually accepting
+ * connections — not merely that the container is "running" or that the
+ * static nginx gateway `/health` is up.
+ *
+ * This is the readiness signal the gateway probe cannot provide: the gateway
+ * `/health` is a literal nginx `return 200` that never proxies a backend, and
+ * the Ory service containers declare no Docker healthcheck, so
+ * `docker compose up -d --wait` returns as soon as they are *started*, well
+ * before they are *serving*. Seeding against that gap intermittently fails to
+ * create identities and permission tuples on cold starts.
+ */
+function seedTargetServices() {
+    return [
+        { name: "Kratos", url: `http://localhost:${configs_js_1.KRATOS_ADMIN_PORT}/health/ready` },
+        { name: "Keto", url: `http://localhost:${configs_js_1.KETO_WRITE_PORT}/health/ready` },
+        { name: "Hydra", url: `http://localhost:${configs_js_1.HYDRA_ADMIN_PORT}/health/ready` },
+    ];
+}
+/**
+ * Wait until every backend service the seed writes to reports ready, polling
+ * at the given interval. Returns `{ ready: true }` on success, or
+ * `{ ready: false, pending }` listing the services that never came up within
+ * the timeout.
+ *
+ * Call this before seeding: it closes the race where the gateway is green and
+ * containers are "running" but Kratos / Keto / Hydra are not yet serving on
+ * their admin/write ports.
+ */
+async function waitForSeedTargets(timeoutMs = 60_000, intervalMs = 1000) {
+    const services = seedTargetServices();
+    const deadline = Date.now() + timeoutMs;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const results = await Promise.all(services.map((s) => checkEndpoint(s.name, s.url)));
+        const pending = results.filter((r) => !r.healthy).map((r) => r.name);
+        if (pending.length === 0)
+            return { ready: true, pending: [] };
+        if (Date.now() >= deadline)
+            return { ready: false, pending };
+        await new Promise((r) => setTimeout(r, intervalMs));
+    }
+}
 /**
  * Wait for the gateway to become healthy, polling at the given interval.
  * Returns true if healthy within the timeout, false otherwise.

package/dist/local/manager.js

@@ -719,8 +719,7 @@ function printSeedResult(result) {
     console.log("Seed complete!");
     console.log("==============");
     console.log("");
-    console.log(`  Agent identity: ${result.agent.identity.email} (${result.agent.identity.id})`);
-    console.log(`                  (OAuth2 client self-registers on first run via DCR)`);
+    console.log(`  Agent identity: self-registers on first run via DCR (nothing seeded)`);
     console.log("");
     console.log(`  User identity:  ${result.user.identity.email} (${result.user.identity.id})`);
     console.log(`  User password:  ${result.user.password}`);
@@ -731,7 +730,6 @@ function printSeedResult(result) {
     console.log("To use with any Ory agent plugin, set these environment variables:");
     console.log("");
     console.log(`  export ORY_PROJECT_URL=${configs_js_1.GATEWAY_URL}`);
-    console.log(`  export ORY_USER_LOGIN=true`);
     console.log(`  export ORY_OAUTH2_CLIENT_ID=${result.user.client.clientId}`);
     console.log(`  export ORY_USER_SUBJECT_NAMESPACE=User`);
     console.log(`  export ORY_USER_SUBJECT_ID=${result.user.identity.id}`);

package/dist/local/seed.d.ts

@@ -1,18 +1,16 @@
 /**
  * Seed the local Ory environment with test data for development.
  *
- * Creates two principals:
+ * Creates the **User** (`user@ory-local.dev`) — a human identity with a
+ * known password (printed by the launcher) and an OAuth2
+ * `authorization_code` + PKCE client registered against the loopback
+ * redirect URIs. The launcher always runs the real PKCE browser flow; the
+ * user types these credentials into the login UI to complete the flow.
  *
- *   1. **Agent** (`agent@ory-local.dev`) — a Kratos identity that the
- *      harness will register a DCR OAuth2 client *for* on first session
- *      start. No OAuth2 client is pre-registered here.
- *
- *   2. **User** (`user@ory-local.dev`) — a human identity with a known
- *      password (printed by the launcher) and an OAuth2
- *      `authorization_code` + PKCE client registered against the
- *      loopback redirect URIs. The launcher always runs the real PKCE
- *      browser flow; the user types these credentials into the login
- *      UI to complete the flow.
+ * No agent principal is seeded: the harness self-registers a DCR OAuth2
+ * client for the agent on first session start (using the user's bearer as
+ * the initial access token), and permission checks are made against the
+ * user subject — so a pre-seeded agent Kratos identity would be unused.
  *
  * Permission tuples are written as SubjectSet `User:<identity.id>` so
  * the Console's *Add relationship* dialog (which always emits SubjectSet
@@ -39,15 +37,6 @@ export interface SeededOAuth2Client {
     clientSecret?: string;
 }
 export interface SeedResult {
-    /**
-     * Agent (machine) identity — Kratos identity only. The agent's OAuth2
-     * client is *not* pre-registered: the harness self-registers via DCR
-     * (RFC 7591) on first session start using the user's bearer as the
-     * initial access token.
-     */
-    agent: {
-        identity: SeededIdentity;
-    };
     /** User (human) identity — subject of permission checks. */
     user: {
         identity: SeededIdentity;

package/dist/local/seed.js

@@ -2,18 +2,16 @@
 /**
  * Seed the local Ory environment with test data for development.
  *
- * Creates two principals:
+ * Creates the **User** (`user@ory-local.dev`) — a human identity with a
+ * known password (printed by the launcher) and an OAuth2
+ * `authorization_code` + PKCE client registered against the loopback
+ * redirect URIs. The launcher always runs the real PKCE browser flow; the
+ * user types these credentials into the login UI to complete the flow.
  *
- *   1. **Agent** (`agent@ory-local.dev`) — a Kratos identity that the
- *      harness will register a DCR OAuth2 client *for* on first session
- *      start. No OAuth2 client is pre-registered here.
- *
- *   2. **User** (`user@ory-local.dev`) — a human identity with a known
- *      password (printed by the launcher) and an OAuth2
- *      `authorization_code` + PKCE client registered against the
- *      loopback redirect URIs. The launcher always runs the real PKCE
- *      browser flow; the user types these credentials into the login
- *      UI to complete the flow.
+ * No agent principal is seeded: the harness self-registers a DCR OAuth2
+ * client for the agent on first session start (using the user's bearer as
+ * the initial access token), and permission checks are made against the
+ * user subject — so a pre-seeded agent Kratos identity would be unused.
  *
  * Permission tuples are written as SubjectSet `User:<identity.id>` so
  * the Console's *Add relationship* dialog (which always emits SubjectSet
@@ -30,11 +28,10 @@ exports.seedLocalEnvironment = seedLocalEnvironment;
 const auth_js_1 = require("../auth.js");
 const tool_catalog_js_1 = require("../tool-catalog.js");
 const configs_js_1 = require("./configs.js");
+const health_js_1 = require("./health.js");
 const KRATOS_ADMIN = `http://localhost:${configs_js_1.KRATOS_ADMIN_PORT}`;
 const KETO_WRITE = `http://localhost:${configs_js_1.KETO_WRITE_PORT}`;
 const HYDRA_ADMIN = `http://localhost:${configs_js_1.HYDRA_ADMIN_PORT}`;
-const AGENT_EMAIL = "agent@ory-local.dev";
-const AGENT_PASSWORD = "ory-agent-local-dev-password!";
 const USER_EMAIL = "user@ory-local.dev";
 const USER_PASSWORD = "ory-user-local-dev-password!";
 const USER_CLIENT_NAME = "ory-agent-plugins-local-user";
@@ -179,10 +176,22 @@ function loopbackRedirectUris() {
  */
 async function seedLocalEnvironment(namespace = "AgentTools") {
     process.stderr.write("Seeding local Ory environment...\n\n");
-    // 1. Identities
-    process.stderr.write("  Creating agent identity...\n");
-    const agentIdentity = await seedIdentity(AGENT_EMAIL, AGENT_PASSWORD, "Local Agent");
-    process.stderr.write(`  Agent: ${agentIdentity.id} (${agentIdentity.email})\n`);
+    // 0. Readiness barrier. The seed writes directly to Kratos (admin),
+    //    Keto (write), and Hydra (admin). Neither the static nginx gateway
+    //    `/health` nor `docker compose up -d --wait` (the Ory containers
+    //    declare no healthcheck) proves those APIs are actually serving, so
+    //    on a cold start the writes can race ahead of the services and
+    //    silently create no identities or permission tuples. Block until all
+    //    three report ready before touching them.
+    process.stderr.write("  Waiting for backend services to be ready...\n");
+    const readiness = await (0, health_js_1.waitForSeedTargets)();
+    if (!readiness.ready) {
+        throw new Error(`backend services not ready before seed: ${readiness.pending.join(", ")} ` +
+            `did not report ready within the timeout. The stack may still be starting — retry in a moment.`);
+    }
+    // 1. User identity. No agent identity is seeded — the harness
+    //    self-registers a DCR OAuth2 client for the agent on first session
+    //    start, and permission checks target the user subject.
     process.stderr.write("  Creating user identity...\n");
     const userIdentity = await seedIdentity(USER_EMAIL, USER_PASSWORD, "Local User");
     process.stderr.write(`  User: ${userIdentity.id} (${userIdentity.email})\n`);
@@ -219,7 +228,6 @@ async function seedLocalEnvironment(namespace = "AgentTools") {
         process.stderr.write(`  Warning: user OAuth2 client registration failed: ${msg}\n`);
     }
     return {
-        agent: { identity: agentIdentity },
         user: { identity: userIdentity, password: USER_PASSWORD, client: userClient },
         permissions: { namespace, subject: subjectLabel, tuples: tupleCount },
     };

package/dist/permissions-cli.js

@@ -258,7 +258,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
         console.error("No user identity resolved — refusing to write permissions for an unknown subject.");
         console.error("");
         console.error("Either:");
-        console.error("  - run the harness once with ORY_USER_LOGIN=true so a user token is cached, or");
+        console.error("  - run the harness once so the user login caches a token, or");
         console.error("  - set ORY_USER_SUBJECT_ID=<id> to target a known subject.");
         return 1;
     }
@@ -288,9 +288,17 @@ async function runPermissionsBootstrap(binName, harness, args) {
             continue;
         }
         try {
-            const res = await client.createRelationship(check, {
-                spanAttributes: { toolName: tool, source: "permissions_bootstrap" },
-            });
+            // Read-before-write: Keto's create API is not idempotent (every PUT
+            // inserts a new row and never 409s), so a plain createRelationship on
+            // re-install would duplicate the whole catalog. ensureRelationship
+            // probes for the exact tuple first and only writes when it is absent.
+            const spanAttributes = { toolName: tool, source: "permissions_bootstrap" };
+            let res = await client.ensureRelationship(check, { spanAttributes });
+            if (res.probeError) {
+                // Couldn't confirm existence — fall back to a direct write so a
+                // needed grant is still created (bootstrap's job is to guarantee it).
+                res = await client.createRelationship(check, { spanAttributes });
+            }
             if (res.alreadyExisted) {
                 existed++;
                 console.log(`  = ${tool}  (already exists)`);

package/dist/project-api-key.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Ory Network **project API key** (project token) lifecycle via the Ory
+ * Console API.
+ *
+ * Runtime permission checks authenticate to Ory's Permission (Keto) API with a
+ * project API key — the agent's OAuth2 token isn't accepted there — so the
+ * installer mints one. The `ory` CLI (as of v1.3) exposes no project-API-key
+ * command, so this is the one place the plugin reaches past the CLI to the
+ * Console API directly, authenticating with the CLI's stored Ory Network
+ * session (`~/.ory-cloud.json`).
+ *
+ * These helpers own the full lifecycle so both the installer (create) and the
+ * uninstaller (delete) speak to the same endpoint with the same auth. Every
+ * function is best-effort and never throws — provisioning and teardown must not
+ * crash on a missing session or a network blip.
+ */
+export interface CreateProjectApiKeyArgs {
+    projectId: string;
+    /** Human-readable label shown in the Console's API-keys list. */
+    name: string;
+}
+/**
+ * A minted project API key. `value` is the `ory_pat_…` secret (returned only at
+ * creation); `id` is the stable token id used to manage/delete the key later.
+ */
+export interface ProjectApiKeyResult {
+    value: string;
+    /** Token id, when the Console returned one — needed for later deletion. */
+    id?: string;
+}
+/** Outcome of a best-effort server-side project-API-key deletion. */
+export type ProjectApiKeyDeleteResult = {
+    status: "deleted";
+}
+/** Nothing to do server-side (no session, or no id to address the token). */
+ | {
+    status: "skipped";
+    message: string;
+} | {
+    status: "failed";
+    message?: string;
+    httpStatus?: number;
+};
+/**
+ * Read the Ory Network session bearer the `ory` CLI stores at
+ * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
+ * no token, or the token has expired. Never throws.
+ */
+export declare function readConsoleSessionToken(): string | null;
+/**
+ * Mint an Ory Network **project API key** via the Console API
+ * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
+ * Returns the `{ value, id }` pair, or null on any failure (no session, non-2xx,
+ * missing value). Never throws — provisioning is best-effort.
+ */
+export declare function createProjectApiKeyViaConsole(args: CreateProjectApiKeyArgs): Promise<ProjectApiKeyResult | null>;
+/**
+ * Delete an Ory Network project API key via the Console API
+ * (`DELETE /projects/{projectId}/tokens/{tokenId}`), authenticated with the
+ * `ory` CLI session. Best-effort and never throws.
+ *
+ * A 404 (already gone) counts as `deleted` — the desired end state is reached.
+ * When no CLI session is available there is nothing we can do server-side, so
+ * the result is `skipped` (not a failure).
+ */
+export declare function deleteProjectApiKeyViaConsole(args: {
+    projectId: string;
+    tokenId: string;
+}): Promise<ProjectApiKeyDeleteResult>;

package/dist/project-api-key.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * Ory Network **project API key** (project token) lifecycle via the Ory
+ * Console API.
+ *
+ * Runtime permission checks authenticate to Ory's Permission (Keto) API with a
+ * project API key — the agent's OAuth2 token isn't accepted there — so the
+ * installer mints one. The `ory` CLI (as of v1.3) exposes no project-API-key
+ * command, so this is the one place the plugin reaches past the CLI to the
+ * Console API directly, authenticating with the CLI's stored Ory Network
+ * session (`~/.ory-cloud.json`).
+ *
+ * These helpers own the full lifecycle so both the installer (create) and the
+ * uninstaller (delete) speak to the same endpoint with the same auth. Every
+ * function is best-effort and never throws — provisioning and teardown must not
+ * crash on a missing session or a network blip.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readConsoleSessionToken = readConsoleSessionToken;
+exports.createProjectApiKeyViaConsole = createProjectApiKeyViaConsole;
+exports.deleteProjectApiKeyViaConsole = deleteProjectApiKeyViaConsole;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/** Base URL for the Ory Console API. Override with `ORY_CONSOLE_API_URL`. */
+const CONSOLE_API_URL = process.env.ORY_CONSOLE_API_URL?.trim() || "https://api.console.ory.sh";
+/** Path to the session the `ory` CLI persists after `ory auth`. */
+const ORY_CLI_SESSION_FILE = ".ory-cloud.json";
+/**
+ * Read the Ory Network session bearer the `ory` CLI stores at
+ * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
+ * no token, or the token has expired. Never throws.
+ */
+function readConsoleSessionToken() {
+    try {
+        const raw = fs.readFileSync(path.join(os.homedir(), ORY_CLI_SESSION_FILE), "utf-8");
+        const parsed = JSON.parse(raw);
+        const token = parsed.access_token?.access_token;
+        if (!token)
+            return null;
+        const expiry = parsed.access_token?.expiry;
+        if (expiry) {
+            const expMs = Date.parse(expiry);
+            if (Number.isFinite(expMs) && expMs <= Date.now())
+                return null;
+        }
+        return token;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Mint an Ory Network **project API key** via the Console API
+ * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
+ * Returns the `{ value, id }` pair, or null on any failure (no session, non-2xx,
+ * missing value). Never throws — provisioning is best-effort.
+ */
+async function createProjectApiKeyViaConsole(args) {
+    const token = readConsoleSessionToken();
+    if (!token)
+        return null;
+    try {
+        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ name: args.name }),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const value = typeof body.value === "string" && body.value.length > 0 ? body.value : null;
+        if (!value)
+            return null;
+        const id = typeof body.id === "string" && body.id.length > 0 ? body.id : undefined;
+        return { value, id };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Delete an Ory Network project API key via the Console API
+ * (`DELETE /projects/{projectId}/tokens/{tokenId}`), authenticated with the
+ * `ory` CLI session. Best-effort and never throws.
+ *
+ * A 404 (already gone) counts as `deleted` — the desired end state is reached.
+ * When no CLI session is available there is nothing we can do server-side, so
+ * the result is `skipped` (not a failure).
+ */
+async function deleteProjectApiKeyViaConsole(args) {
+    const token = readConsoleSessionToken();
+    if (!token) {
+        return {
+            status: "skipped",
+            message: "no Ory Console session (run `ory auth` to enable server-side removal)",
+        };
+    }
+    try {
+        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens/${args.tokenId}`, {
+            method: "DELETE",
+            headers: { Authorization: `Bearer ${token}` },
+        });
+        if (res.ok || res.status === 404)
+            return { status: "deleted" };
+        return { status: "failed", httpStatus: res.status };
+    }
+    catch (err) {
+        return { status: "failed", message: err?.message };
+    }
+}

package/dist/registry/manager.js

@@ -139,32 +139,72 @@ function readPackageName(pkgJsonPath) {
     }
 }
 /**
- * Strip `publishConfig.registry` and `publishConfig.provenance` from every
- * `@ory/*` package.json for the duration of `fn`, then restore.
+ * Compute a unique local-dev version for a publish run: the base version's
+ * `major.minor.patch` with a `-dev.<timestamp>` prerelease suffix (e.g.
+ * `0.13.9-dev.1721710000000`). All `@ory/*` packages share one version (the
+ * changesets `fixed` group), so we read the base from the first package and
+ * stamp the same value onto every package — keeping `workspace:*` cross-deps
+ * resolvable to the just-published version.
  *
- * The OIDC trusted-publishing release workflow pins each package's
- * `publishConfig.registry` to `https://registry.npmjs.org/` with
- * `provenance: true`. `publishConfig` overrides both the `--registry` CLI
- * flag and the `npm_config_registry` env var on `pnpm publish`, so without
- * this transform `pnpm publish --registry http://localhost:4873` still
- * targets real npmjs.org and fails with `E404 undefined` (no auth) /
- * provenance errors. We unset the two fields only on disk for the publish
- * call, then put the files back exactly as they were so the CI release
- * workflow keeps working.
+ * Why a fresh version every publish: `npx`/pacote cache installed trees and
+ * tarballs by `name@version`. Republishing the *same* version over a rebuilt
+ * tarball lets a client's `~/.npm/_npx` or `_cacache` serve stale bytes even
+ * after Verdaccio has the fresh code. A new version each run guarantees a
+ * cache miss so `@latest` always resolves to what we just built.
+ */
+function makeLocalDevVersion(pkgJsonFiles, stamp) {
+    let base = "0.0.0";
+    for (const file of pkgJsonFiles) {
+        try {
+            const v = JSON.parse(fs.readFileSync(file, "utf-8")).version;
+            if (v) {
+                base = v;
+                break;
+            }
+        }
+        catch {
+            // ignore unreadable package.json; fall back to the next one
+        }
+    }
+    // Strip any existing prerelease/build suffix so we don't stack `-dev` tags.
+    const core = base.split(/[-+]/)[0];
+    return `${core}-dev.${stamp}`;
+}
+/**
+ * Prepare every `@ory/*` package.json for a local publish for the duration of
+ * `fn`, then restore each file exactly as it was. Two transforms are applied:
+ *
+ *  1. **Strip `publishConfig.registry` / `publishConfig.provenance`.** The OIDC
+ *     trusted-publishing release workflow pins each package's
+ *     `publishConfig.registry` to `https://registry.npmjs.org/` with
+ *     `provenance: true`. `publishConfig` overrides both the `--registry` CLI
+ *     flag and the `npm_config_registry` env var, so without this transform a
+ *     local publish still targets real npmjs.org and fails with `E404
+ *     undefined` (no auth) / provenance errors.
+ *
+ *  2. **Stamp a unique `-dev.<timestamp>` version** (see
+ *     {@link makeLocalDevVersion}) so `@latest` changes on every publish and
+ *     clients can't serve a stale cached tarball for a version we already used.
+ *
+ * Both are on-disk only for the publish call; the files are put back exactly as
+ * they were so the CI release workflow (and git) keep working.
  */
 async function withLocalPublishConfig(workspaceRoot, fn) {
     const files = listWorkspaceScopedPackageJsons(workspaceRoot);
+    const stamp = Date.now();
+    const devVersion = makeLocalDevVersion(files, stamp);
     const backups = new Map();
     for (const file of files) {
         const original = fs.readFileSync(file, "utf-8");
         const pkg = JSON.parse(original);
-        if (!pkg.publishConfig)
-            continue;
-        const stripped = { ...pkg.publishConfig };
-        delete stripped.registry;
-        delete stripped.provenance;
+        const next = { ...pkg, version: devVersion };
+        if (pkg.publishConfig) {
+            const stripped = { ...pkg.publishConfig };
+            delete stripped.registry;
+            delete stripped.provenance;
+            next.publishConfig = stripped;
+        }
         backups.set(file, original);
-        const next = { ...pkg, publishConfig: stripped };
         fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
     }
     const restore = () => {
@@ -461,7 +501,7 @@ async function publishAllOryToLocal(opts = {}) {
             const { name, version } = readPackageNameVersion(pkgJsonPath);
             const pkgName = name ?? path.basename(pkgDir);
             if (!opts.quiet) {
-                console.log(`Publishing ${pkgName}...`);
+                console.log(`Publishing ${pkgName}@${version}...`);
             }
             const packResult = (0, node_child_process_1.spawnSync)("pnpm", ["pack", "--pack-destination", packDir], {
                 cwd: pkgDir,
@@ -495,6 +535,10 @@ async function publishAllOryToLocal(opts = {}) {
                 config_js_1.REGISTRY_URL,
                 ...scopeRegistryArg,
                 "--access=public",
+                // Explicit so a `-dev.<ts>` prerelease still becomes `@latest` in the
+                // local registry (some npm versions won't auto-tag prereleases).
+                "--tag",
+                "latest",
             ], {
                 cwd: pkgDir,
                 stdio: opts.quiet ? "pipe" : "inherit",