@ory/argus 0.13.9 → 1.0.0

package/dist/registry/manager.js

@@ -7,9 +7,8 @@
  * container is started with `--rm` and all state lives under
  * `.ory-dev/registry/` on the host, bind-mounted into the container.
  *
- * Mirrors the lifecycle model used by the standalone Jaeger container
- * (see `local/jaeger.ts`): single `docker run -d --rm --name <name>`,
- * idempotent start, removal via `docker rm -f`.
+ * Uses one detached, auto-removed container with idempotent startup and
+ * removal via `docker rm -f`.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -46,14 +45,12 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLocalRegistryNpmCacheDir = getLocalRegistryNpmCacheDir;
-exports.getLauncherNpmrcPath = getLauncherNpmrcPath;
-exports.ensureLauncherNpmrc = ensureLauncherNpmrc;
 exports.ensureRegistryRunning = ensureRegistryRunning;
-exports.publishHarnessToLocal = publishHarnessToLocal;
 exports.registryStart = registryStart;
 exports.registryStop = registryStop;
 exports.registryStatus = registryStatus;
 exports.registryPublish = registryPublish;
+exports.registryDev = registryDev;
 exports.registryClean = registryClean;
 exports.registryNpmrc = registryNpmrc;
 const fs = __importStar(require("node:fs"));
@@ -86,29 +83,15 @@ function getRegistryDir() {
 function getLocalRegistryNpmCacheDir() {
     return path.join(getRegistryDir(), "npm-cache");
 }
-/**
- * Path to the userconfig npmrc the dev launcher hands to its subprocesses.
- * See `launcherNpmrcContent` in `./config.ts` for why this exists.
- */
-function getLauncherNpmrcPath() {
-    return path.join(getRegistryDir(), "launcher.npmrc");
-}
-/**
- * Materialize the launcher userconfig npmrc on disk and return its path.
- * Idempotent: rewrites the file every call so any drift in the rendered
- * content (e.g. registry URL change) lands without a clean-and-restart.
- */
-function ensureLauncherNpmrc() {
-    const npmrcPath = getLauncherNpmrcPath();
-    ensureDir(path.dirname(npmrcPath));
-    fs.writeFileSync(npmrcPath, (0, config_js_1.launcherNpmrcContent)());
-    return npmrcPath;
-}
 function ensureDir(dir) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
     }
 }
+function writeRegistryNpmrc(registryDir) {
+    ensureDir(registryDir);
+    fs.writeFileSync(path.join(registryDir, ".npmrc"), (0, config_js_1.npmrcContent)());
+}
 function listWorkspaceScopedPackages(workspaceRoot) {
     return listWorkspaceScopedPackageJsons(workspaceRoot)
         .map((file) => readPackageName(file))
@@ -139,32 +122,72 @@ function readPackageName(pkgJsonPath) {
     }
 }
 /**
- * Strip `publishConfig.registry` and `publishConfig.provenance` from every
- * `@ory/*` package.json for the duration of `fn`, then restore.
+ * Compute a unique local-dev version for a publish run: the base version's
+ * `major.minor.patch` with a `-dev.<timestamp>` prerelease suffix (e.g.
+ * `0.13.9-dev.1721710000000`). All `@ory/*` packages share one version (the
+ * changesets `fixed` group), so we read the base from the first package and
+ * stamp the same value onto every package — keeping `workspace:*` cross-deps
+ * resolvable to the just-published version.
+ *
+ * Why a fresh version every publish: `npx`/pacote cache installed trees and
+ * tarballs by `name@version`. Republishing the *same* version over a rebuilt
+ * tarball lets a client's `~/.npm/_npx` or `_cacache` serve stale bytes even
+ * after Verdaccio has the fresh code. A new version each run guarantees a
+ * cache miss so `@latest` always resolves to what we just built.
+ */
+function makeLocalDevVersion(pkgJsonFiles, stamp) {
+    let base = "0.0.0";
+    for (const file of pkgJsonFiles) {
+        try {
+            const v = JSON.parse(fs.readFileSync(file, "utf-8")).version;
+            if (v) {
+                base = v;
+                break;
+            }
+        }
+        catch {
+            // ignore unreadable package.json; fall back to the next one
+        }
+    }
+    // Strip any existing prerelease/build suffix so we don't stack `-dev` tags.
+    const core = base.split(/[-+]/)[0];
+    return `${core}-dev.${stamp}`;
+}
+/**
+ * Prepare every `@ory/*` package.json for a local publish for the duration of
+ * `fn`, then restore each file exactly as it was. Two transforms are applied:
+ *
+ *  1. **Strip `publishConfig.registry` / `publishConfig.provenance`.** The OIDC
+ *     trusted-publishing release workflow pins each package's
+ *     `publishConfig.registry` to `https://registry.npmjs.org/` with
+ *     `provenance: true`. `publishConfig` overrides both the `--registry` CLI
+ *     flag and the `npm_config_registry` env var, so without this transform a
+ *     local publish still targets real npmjs.org and fails with `E404
+ *     undefined` (no auth) / provenance errors.
  *
- * The OIDC trusted-publishing release workflow pins each package's
- * `publishConfig.registry` to `https://registry.npmjs.org/` with
- * `provenance: true`. `publishConfig` overrides both the `--registry` CLI
- * flag and the `npm_config_registry` env var on `pnpm publish`, so without
- * this transform `pnpm publish --registry http://localhost:4873` still
- * targets real npmjs.org and fails with `E404 undefined` (no auth) /
- * provenance errors. We unset the two fields only on disk for the publish
- * call, then put the files back exactly as they were so the CI release
- * workflow keeps working.
+ *  2. **Stamp a unique `-dev.<timestamp>` version** (see
+ *     {@link makeLocalDevVersion}) so `@latest` changes on every publish and
+ *     clients can't serve a stale cached tarball for a version we already used.
+ *
+ * Both are on-disk only for the publish call; the files are put back exactly as
+ * they were so the CI release workflow (and git) keep working.
  */
 async function withLocalPublishConfig(workspaceRoot, fn) {
     const files = listWorkspaceScopedPackageJsons(workspaceRoot);
+    const stamp = Date.now();
+    const devVersion = makeLocalDevVersion(files, stamp);
     const backups = new Map();
     for (const file of files) {
         const original = fs.readFileSync(file, "utf-8");
         const pkg = JSON.parse(original);
-        if (!pkg.publishConfig)
-            continue;
-        const stripped = { ...pkg.publishConfig };
-        delete stripped.registry;
-        delete stripped.provenance;
+        const next = { ...pkg, version: devVersion };
+        if (pkg.publishConfig) {
+            const stripped = { ...pkg.publishConfig };
+            delete stripped.registry;
+            delete stripped.provenance;
+            next.publishConfig = stripped;
+        }
         backups.set(file, original);
-        const next = { ...pkg, publishConfig: stripped };
         fs.writeFileSync(file, JSON.stringify(next, null, 2) + "\n");
     }
     const restore = () => {
@@ -372,9 +395,10 @@ async function ensureConfigInSync(quiet) {
  * Start the local registry if it isn't already running.
  */
 async function ensureRegistryRunning() {
-    if (isRegistryRunning())
-        return;
-    await registryStart();
+    if (!isRegistryRunning()) {
+        await registryStart();
+    }
+    writeRegistryNpmrc(getRegistryDir());
 }
 /**
  * Env vars stripped before invoking the per-package publish, mirroring the
@@ -461,7 +485,7 @@ async function publishAllOryToLocal(opts = {}) {
             const { name, version } = readPackageNameVersion(pkgJsonPath);
             const pkgName = name ?? path.basename(pkgDir);
             if (!opts.quiet) {
-                console.log(`Publishing ${pkgName}...`);
+                console.log(`Publishing ${pkgName}@${version}...`);
             }
             const packResult = (0, node_child_process_1.spawnSync)("pnpm", ["pack", "--pack-destination", packDir], {
                 cwd: pkgDir,
@@ -495,6 +519,10 @@ async function publishAllOryToLocal(opts = {}) {
                 config_js_1.REGISTRY_URL,
                 ...scopeRegistryArg,
                 "--access=public",
+                // Explicit so a `-dev.<ts>` prerelease still becomes `@latest` in the
+                // local registry (some npm versions won't auto-tag prereleases).
+                "--tag",
+                "latest",
             ], {
                 cwd: pkgDir,
                 stdio: opts.quiet ? "pipe" : "inherit",
@@ -553,20 +581,12 @@ function emitCapturedOutput(quiet, label, result) {
 function stripScheme(url) {
     return url.replace(/^https?:\/\//, "");
 }
-/**
- * Publish all `@ory/*` packages to the local registry — entrypoint used by
- * the dev launcher. The `harnessName` arg is retained for call-site
- * compatibility; we publish the whole scope every time so any harness gets
- * a coherent registry state without needing to compute its dep closure.
- */
-async function publishHarnessToLocal(_harnessName) {
-    await publishAllOryToLocal({ quiet: true });
-}
 // ─── Commands ──────────────────────────────────────────────────────
 async function registryStart() {
     const registryDir = getRegistryDir();
     const storageDir = path.join(registryDir, "storage");
     if (isRegistryRunning()) {
+        writeRegistryNpmrc(registryDir);
         console.log(`Local registry is already running (container ${config_js_1.REGISTRY_CONTAINER}).`);
         console.log(`  URL: ${config_js_1.REGISTRY_URL}`);
         return;
@@ -598,7 +618,7 @@ async function registryStart() {
     const configPath = path.join(registryDir, "config.yaml");
     fs.writeFileSync(configPath, (0, config_js_1.verdaccioConfigYaml)());
     // .npmrc is consumed by host-side npm/pnpm tooling, not by the container.
-    fs.writeFileSync(path.join(registryDir, ".npmrc"), (0, config_js_1.npmrcContent)());
+    writeRegistryNpmrc(registryDir);
     // Stale --rm container could only exist if Docker died mid-run; clean it up
     // so the new `docker run --rm` doesn't collide on the container name.
     const state = inspectContainer(config_js_1.REGISTRY_CONTAINER);
@@ -754,6 +774,14 @@ async function registryPublish() {
     console.log("");
     console.log("Published.");
 }
+/** Start the local registry and publish a coherent development package set. */
+async function registryDev() {
+    await ensureRegistryRunning();
+    await registryPublish();
+    console.log("");
+    console.log(`Plugin packages are available from ${config_js_1.REGISTRY_URL} at the latest tag.`);
+    console.log("Local Lite and Ory Agent Security are expected to be running separately.");
+}
 async function registryClean() {
     // Stop first if running
     await registryStop();

package/dist/runtime-credential.d.ts

@@ -0,0 +1,140 @@
+/** The broker header a runtime credential must occupy for a request. */
+export type RuntimeAuthorizationHeader = "authorization" | "x-ory-agent-authorization";
+export interface RuntimeAuthenticatedRequest {
+    url: string;
+    init: RequestInit;
+    authorizationHeader: RuntimeAuthorizationHeader;
+    /** Default transport. An mTLS authenticator may ignore this and use its own transport. */
+    fetch: typeof fetch;
+    /** Whether `fetch` is the core's default transport rather than an injected implementation. */
+    usesDefaultFetch?: boolean;
+}
+/**
+ * Executes one noninteractive Agent Security request. Custom Agent SDK
+ * integrations can use this hook to attach a SPIFFE workload identity and run
+ * the request over mTLS without exposing key material to Argus.
+ */
+export type RuntimeRequestAuthenticator = (request: RuntimeAuthenticatedRequest) => Promise<Response>;
+export type RuntimeCredentialKind = "talos" | "injected";
+export interface RuntimeCredential {
+    kind: RuntimeCredentialKind;
+    subject?: string;
+    authenticate: RuntimeRequestAuthenticator;
+}
+export interface ResolveRuntimeCredentialOptions {
+    env?: NodeJS.ProcessEnv;
+    requestAuthenticator?: RuntimeRequestAuthenticator;
+    subject?: string;
+    fetch?: typeof fetch;
+}
+export interface EnrollTalosRuntimeCredentialOptions {
+    projectUrl: string;
+    agentSecurityUrl: string;
+    userToken: string;
+    name: string;
+    idempotencyKey: string;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    credentialStore?: TalosCredentialStore;
+    identity?: TalosCredentialIdentity;
+    /** @internal Injectable seam for testing default-fetch TLS setup. */
+    configureSystemCaTrust?: () => void;
+}
+export interface EnrolledRuntimeCredential {
+    credential: RuntimeCredential;
+    actorId: string;
+    warnings: string[];
+}
+export type TalosCredentialIdentity = {
+    projectUrl: string;
+    harness: string;
+    sessionId: string;
+    kind: "agent";
+} | {
+    projectUrl: string;
+    harness: string;
+    sessionId: string;
+    kind: "subagent";
+    subAgentType: string;
+    perSpawnId: string;
+};
+export interface StoredTalosCredentialV2 {
+    version: 2;
+    credential: string;
+    actorId: string;
+    credentialId?: string;
+    expiresAt?: string;
+    identity: TalosCredentialIdentity;
+}
+export interface StoredTalosCredentialV1 {
+    version: 1;
+    credential: string;
+    actorId: string;
+}
+export type StoredTalosCredential = StoredTalosCredentialV1 | StoredTalosCredentialV2;
+export type TalosCredentialStoreIdentity = TalosCredentialIdentity | string;
+export interface TalosCredentialStore {
+    load(identity: TalosCredentialStoreIdentity): Promise<StoredTalosCredential | undefined>;
+    save(identity: TalosCredentialStoreIdentity, secret: StoredTalosCredential): Promise<void>;
+}
+export interface CredentialStoreCommandOptions {
+    input?: string;
+}
+export type CredentialStoreCommandRunner = (command: string, args: string[], options?: CredentialStoreCommandOptions) => Promise<{
+    stdout: string;
+}>;
+export interface OsTalosCredentialStoreOptions {
+    platform?: NodeJS.Platform;
+    runCommand?: CredentialStoreCommandRunner;
+}
+export interface NodeTlsCaProvider {
+    getCACertificates?: (type?: "default" | "system" | "bundled" | "extra") => string[];
+    setDefaultCACertificates?: (certificates: ReadonlyArray<string | NodeJS.ArrayBufferView>) => void;
+}
+/**
+ * Make subsequent default Node TLS connections trust both Node's existing CA
+ * set and the operating system trust store. This is process-local and does not
+ * disable certificate verification.
+ */
+export declare function configureSystemCaTrustForDefaultFetch(provider?: NodeTlsCaProvider): boolean;
+export declare class CredentialStoreCommandError extends Error {
+    readonly exitCode?: number | undefined;
+    readonly causeCode?: string | undefined;
+    constructor(message: string, exitCode?: number | undefined, causeCode?: string | undefined);
+}
+export declare const runCredentialStoreCommand: CredentialStoreCommandRunner;
+/** Normalize equivalent project URLs before deriving their credential-store key. */
+export declare function canonicalProjectUrl(projectUrl: string): string;
+export declare function canonicalCredentialIdentity(identity: TalosCredentialStoreIdentity): TalosCredentialIdentity;
+export declare function credentialAccount(identity: TalosCredentialStoreIdentity): string;
+/** OS-backed Talos store. Secrets are never placed in process arguments. */
+export declare function createOsTalosCredentialStore(options?: OsTalosCredentialStoreOptions): TalosCredentialStore;
+export declare function talosRuntimeCredential(apiKey: string, options?: {
+    subject?: string;
+    fetch?: typeof fetch;
+    /** @internal Injectable seam for testing default-fetch TLS setup. */
+    configureSystemCaTrust?: () => void;
+}): RuntimeCredential;
+/** Resolve only noninteractive runtime credentials. No persisted state is read. */
+export declare function resolveRuntimeCredential(options?: ResolveRuntimeCredentialOptions): RuntimeCredential | undefined;
+/** Explicitly enroll a Talos credential and optionally persist it in an OS store. */
+export declare function enrollTalosRuntimeCredential(options: EnrollTalosRuntimeCredentialOptions): Promise<EnrolledRuntimeCredential>;
+export interface EnrollTalosChildRuntimeCredentialOptions {
+    projectUrl: string;
+    agentSecurityUrl: string;
+    name: string;
+    subAgentType: string;
+    idempotencyKey: string;
+    parentCredential: RuntimeCredential;
+    identity: Extract<TalosCredentialIdentity, {
+        kind: "subagent";
+    }>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    credentialStore?: TalosCredentialStore;
+}
+/** Enroll a separately keyed child using the authenticated parent runtime. */
+export declare function enrollTalosChildRuntimeCredential(options: EnrollTalosChildRuntimeCredentialOptions): Promise<EnrolledRuntimeCredential>;
+export declare function authenticatedRuntimeRequest(credential: RuntimeCredential, request: Omit<RuntimeAuthenticatedRequest, "fetch" | "usesDefaultFetch"> & {
+    fetch?: typeof fetch;
+}): Promise<Response>;