@ory/argus 0.13.9 → 1.0.0

package/dist/interactive-setup.js

@@ -1,1546 +0,0 @@
-"use strict";
-/**
- * Interactive install wizard. Runs after a harness plugin has been
- * registered, stepping the user through connecting the plugin to Ory:
- *
- *   1. Choose a connection: **Ory Network** (browser login / account
- *      creation) or **local / audit-only** (no project, audit logging only).
- *   2. Ory Network branch: shell out to the official `ory` CLI to log in,
- *      pick a workspace, pick a project (→ `projectUrl`), and create the
- *      public OAuth2 client the PKCE user login needs (→ `oauth2ClientId`).
- *   3. Persist the resolved values to the shared config file and enable the
- *      interactive user login.
- *   4. Best-effort "full setup": run the PKCE user login now (we hold the
- *      project URL + client id), resolve the agent DCR identity, and let the
- *      caller bootstrap permissions from the freshly-cached user identity.
- *
- * The whole wizard is **fail-open and skippable**: on a missing TTY, a
- * `--no-configure` flag, an already-configured plugin (without
- * `--reconfigure`), a missing `ory` CLI, or any `ory` failure it prints the
- * manual `configure` instructions and returns without throwing. Install must
- * never crash because setup was declined or the network was unreachable.
- *
- * The Ory Network integration deliberately reuses the official `ory` CLI
- * rather than re-implementing the Console API: the CLI already owns Network
- * browser login + account creation, workspace/project listing, and OAuth2
- * client creation, and the client it creates is exactly the one the plugin
- * READMEs document for manual setup. The one exception is minting the project
- * API key that runtime permission checks need — the CLI exposes no command for
- * it, so that single step calls the Console API directly, reusing the CLI's
- * stored session for auth (see {@link createProjectApiKeyViaConsole}).
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ORY_CLI_NPM_SPEC = exports.LOOPBACK_REDIRECT_URIS = void 0;
-exports.createOryRunner = createOryRunner;
-exports.runPostInstall = runPostInstall;
-exports.runInteractiveSetup = runInteractiveSetup;
-exports.projectUrlFromSlug = projectUrlFromSlug;
-exports.createProjectApiKeyViaConsole = createProjectApiKeyViaConsole;
-exports.apiKeyAuthenticates = apiKeyAuthenticates;
-const node_child_process_1 = require("node:child_process");
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-const tty = __importStar(require("node:tty"));
-const readline = __importStar(require("node:readline"));
-const config_js_1 = require("./config.js");
-const setup_js_1 = require("./setup.js");
-const cli_js_1 = require("./cli.js");
-const cli_invocation_js_1 = require("./cli-invocation.js");
-const auth_js_1 = require("./auth.js");
-const client_js_1 = require("./client.js");
-const logger_js_1 = require("./logger.js");
-const user_login_js_1 = require("./user-login.js");
-const agent_auth_js_1 = require("./agent-auth.js");
-const tool_catalog_js_1 = require("./tool-catalog.js");
-const index_js_1 = require("./local/index.js");
-const subject_js_1 = require("./subject.js");
-const permissions_cli_js_1 = require("./permissions-cli.js");
-const version_cli_js_1 = require("./version-cli.js");
-const ui = __importStar(require("./ui.js"));
-/** Loopback redirect URIs the PKCE user login expects on the OAuth2 client. */
-exports.LOOPBACK_REDIRECT_URIS = auth_js_1.LOOPBACK_PORTS.map((port) => `http://127.0.0.1:${port}/callback`);
-/**
- * Build a runner bound to a specific `ory` binary (a bare command resolved on
- * `PATH`, or an absolute path to a plugin-installed binary). {@link defaultRunner}
- * uses the bare `"ory"`; {@link installOryCli} returns one bound to the binary
- * it just installed.
- */
-function createOryRunner(oryBin) {
-    return {
-        exec(args, opts) {
-            const r = (0, node_child_process_1.spawnSync)(oryBin, args, {
-                encoding: "utf-8",
-                ...(opts?.input !== undefined ? { input: opts.input } : {}),
-            });
-            return {
-                status: r.status,
-                stdout: r.stdout ?? "",
-                stderr: r.stderr ?? "",
-            };
-        },
-        execInteractive(args) {
-            const r = (0, node_child_process_1.spawnSync)(oryBin, args, { stdio: "inherit" });
-            return r.status ?? 1;
-        },
-    };
-}
-const defaultRunner = createOryRunner("ory");
-/**
- * npm spec for the Ory CLI installed on demand when the `ory` binary isn't on
- * `PATH`. `@ory/cli` ships the platform `ory` binary and exposes it as its
- * `bin`, so an isolated `npm install` gives us a working CLI without touching
- * the user's global environment. Pinned to a major to stay reproducible while
- * still picking up patch/minor fixes.
- */
-exports.ORY_CLI_NPM_SPEC = "@ory/cli@^1";
-/**
- * Best-effort install of the Ory CLI into a plugin-managed directory under the
- * shared data dir, returning a runner bound to the installed binary (or null
- * on any failure). Uses `npm install --prefix` so nothing global is modified;
- * the binary lands at `<dataDir>/cli/node_modules/.bin/ory`. Never throws.
- */
-async function installOryCli() {
-    const dir = path.join((0, config_js_1.getDataDir)(), "cli");
-    try {
-        fs.mkdirSync(dir, { recursive: true });
-    }
-    catch {
-        return null;
-    }
-    const npm = process.platform === "win32" ? "npm.cmd" : "npm";
-    const r = (0, node_child_process_1.spawnSync)(npm, ["install", "--prefix", dir, "--no-save", "--no-audit", "--no-fund", exports.ORY_CLI_NPM_SPEC], { encoding: "utf-8", stdio: ["ignore", "ignore", "pipe"] });
-    if (r.status !== 0)
-        return null;
-    const binName = process.platform === "win32" ? "ory.cmd" : "ory";
-    const bin = path.join(dir, "node_modules", ".bin", binName);
-    if (!fs.existsSync(bin))
-        return null;
-    const runner = createOryRunner(bin);
-    // Confirm the freshly installed binary actually runs before handing it back.
-    return oryCliPresent(runner) ? runner : null;
-}
-/**
- * The shared post-install entry point every harness's `install` command
- * calls. Runs the interactive setup wizard, then (using whatever identity the
- * wizard cached) bootstraps permissions and prints the onboarding banner.
- *
- * This is the single seam that centralizes what each harness previously
- * open-coded as a local `postInstallPermissions` helper.
- */
-async function runPostInstall(binName, harness, args = [], deps = {}) {
-    // Surface the running CLI version up front. `npx -p @ory/<harness>` (no
-    // version pin) will happily reuse a previously-cached install rather than
-    // re-resolve to latest, so a user can silently be running an old CLI whose
-    // install flow predates newer behavior (e.g. the interactive setup wizard)
-    // while believing they're on the current release. Printing the version makes
-    // that mismatch visible at a glance; the README's troubleshooting note
-    // explains how to clear a stale npx cache.
-    const cliVersion = (0, version_cli_js_1.resolveCoreVersion)();
-    if (cliVersion !== "unknown") {
-        ui.info(`${binName} v${cliVersion}`);
-    }
-    const result = await runInteractiveSetup(binName, harness, args, deps);
-    // The Ory Network wizard path bootstraps permissions itself (via the
-    // admin-authenticated `ory` CLI). Only fall back to the DCR-token bootstrap
-    // when the wizard didn't handle it — otherwise we'd emit 403s on a hosted
-    // project whose relation-tuple API rejects the agent/user token.
-    const bootstrapped = result.skipAutoBootstrap
-        ? false
-        : await (0, permissions_cli_js_1.maybeAutoBootstrap)(binName, harness);
-    (0, permissions_cli_js_1.printPermissionsOnboardingHelp)(binName, harness, {
-        bootstrappedAutomatically: bootstrapped,
-    });
-    // Flush any next-steps guidance the harness's install() deferred, so it
-    // lands at the very end of the interactive flow rather than above the
-    // wizard's first prompt. When the wizard already connected Ory, the renderer
-    // prints a short launch summary instead of the manual setup steps — those
-    // would only contradict the values the wizard just saved.
-    (0, setup_js_1.emitDeferredNextSteps)(isConfiguredOutcome(result.outcome));
-}
-/**
- * Outcomes where Ory is already wired up by the time the wizard returns —
- * either the user connected it now (network / local / audit-only) or it was
- * configured on a previous run. For these the closing next-steps should be a
- * short "launch the harness" summary, not the manual env-var guidance.
- */
-function isConfiguredOutcome(outcome) {
-    return (outcome === "network_configured" ||
-        outcome === "local_configured" ||
-        outcome === "audit_only" ||
-        outcome === "skipped_configured");
-}
-/**
- * Run the interactive setup wizard. Always resolves; never throws.
- */
-async function runInteractiveSetup(binName, harness, args = [], deps = {}) {
-    const runner = deps.runner ?? defaultRunner;
-    const ttyAvailable = deps.isTtyAvailableFn ?? cli_js_1.isTtyAvailable;
-    const noConfigure = args.includes("--no-configure");
-    const reconfigure = args.includes("--reconfigure");
-    if (noConfigure) {
-        return { outcome: "skipped_flag" };
-    }
-    if (!ttyAvailable()) {
-        // Non-interactive (CI/headless) — preserve the pre-wizard behavior and
-        // point the operator at the manual, scriptable path.
-        printManualSetup(binName);
-        return { outcome: "skipped_no_tty" };
-    }
-    const resolved = (0, config_js_1.resolveConfig)();
-    if ((resolved.projectUrl || resolved.auditOnly) && !reconfigure) {
-        ui.banner("Ory Agent Plugin", "Already connected to Ory");
-        ui.blank();
-        ui.success("Ory is already configured for the agent plugins.");
-        ui.summary([
-            ["Mode", resolved.auditOnly ? "audit-only (no project)" : "connected"],
-            ["Project URL", resolved.auditOnly ? undefined : resolved.projectUrl],
-            ["Config", (0, config_js_1.getConfigPath)()],
-        ]);
-        ui.blank();
-        ui.hint(`Re-run with ${ui.inlineCommand("--reconfigure")} to change it.`);
-        return { outcome: "skipped_configured" };
-    }
-    // The wizard prompts several times in a row. Opening `/dev/tty` afresh for
-    // each prompt (as `promptOnTty` does) leaves a blocking read stuck in
-    // libuv's threadpool per call, and after a few prompts the pool is
-    // exhausted and the next prompt hangs. So when we're driving real TTY input
-    // (no injected promptFn), open one readline interface and reuse it for the
-    // whole flow. Tests inject their own promptFn and skip this entirely.
-    // One persistent tty prompter, but recreated around any interactive child
-    // process. A readline over `/dev/tty` that stays open across a
-    // `spawnSync(..., { stdio: "inherit" })` (how `execInteractive` runs the
-    // `ory auth` browser login) stops receiving input once the child returns —
-    // the terminal is left in a state the parent readline no longer reads from,
-    // so the *next* prompt (e.g. workspace selection) hangs forever with no
-    // output. `runInteractive` closes the prompter before the child and reopens
-    // a fresh one after, which reliably restores line input.
-    let ttyPrompter = deps.promptFn ? null : createTtyPrompter();
-    const prompt = (q) => (deps.promptFn ?? ttyPrompter?.prompt ?? cli_js_1.promptOnTty)(q);
-    const runInteractive = (fn) => {
-        if (deps.promptFn || !ttyPrompter)
-            return fn();
-        ttyPrompter.close();
-        ttyPrompter = null;
-        try {
-            return fn();
-        }
-        finally {
-            ttyPrompter = createTtyPrompter();
-        }
-    };
-    // Quiet the structured stderr firehose for the duration of the wizard so
-    // `[ory-agent] {...}` debug lines don't interleave with the human-facing UI
-    // when a session runs with ORY_AGENT_DEBUG=true (the dev launcher always
-    // sets it). Debug still lands in the log file.
-    try {
-        return await (0, logger_js_1.withQuietStderr)(() => runWizard(binName, harness, { runner, prompt, deps, runInteractive }));
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn("");
-        ui.warning(`Interactive setup did not complete: ${msg}`);
-        printManualSetup(binName);
-        return { outcome: "network_fallback" };
-    }
-    finally {
-        ttyPrompter?.close();
-    }
-}
-/**
- * Open `/dev/tty` once and wrap it in a single readline interface, reused for
- * every prompt in the wizard.
- *
- * Crucially this uses `tty.ReadStream`, not `fs.createReadStream`. Reading a
- * tty via an fs stream issues a *blocking* `read()` in libuv's threadpool that
- * can't be cancelled; a pending one exhausts the pool (hanging mid-flow) and,
- * worse, blocks `process.exit()` from ever completing (hanging at the very
- * end). `tty.ReadStream` uses libuv's non-blocking tty handle instead, which is
- * event-loop integrated and tears down cleanly on exit. Returns null if
- * `/dev/tty` can't be opened (caller falls back to `promptOnTty`).
- */
-function createTtyPrompter() {
-    let fd;
-    try {
-        fd = fs.openSync("/dev/tty", "r");
-    }
-    catch {
-        return null;
-    }
-    let input;
-    try {
-        input = new tty.ReadStream(fd);
-    }
-    catch {
-        try {
-            fs.closeSync(fd);
-        }
-        catch {
-            /* ignore */
-        }
-        return null;
-    }
-    const rl = readline.createInterface({ input, output: process.stderr });
-    return {
-        prompt: (question) => new Promise((resolve) => rl.question(question, (answer) => resolve(answer.trim()))),
-        close: () => {
-            rl.close();
-            input.destroy();
-            try {
-                fs.closeSync(fd);
-            }
-            catch {
-                /* fd may already be closed by the stream */
-            }
-        },
-    };
-}
-async function runWizard(binName, harness, ctx) {
-    ui.banner("Ory Agent Plugin", "Connect your agent to Ory");
-    ui.heading("How do you want to connect?");
-    ui.blank();
-    ui.menu([
-        {
-            key: "1",
-            label: "Ory Network",
-            description: "sign in (or create an account) and connect a hosted project",
-        },
-        {
-            key: "2",
-            label: "Local stack",
-            description: "self-hosted Ory via `local up` (localhost:4000), seeded for you",
-        },
-        {
-            key: "3",
-            label: "Audit-only",
-            description: "no Ory project (traces tool calls locally, no auth or checks)",
-        },
-    ]);
-    ui.blank();
-    const choice = await ctx.prompt(ui.promptLine("Enter 1, 2 or 3", { hint: "[1]" }));
-    // Default to the Ory Network path (empty / "1"). "2" wires up the local
-    // stack — where every value comes from the seeded stack, no prompts needed.
-    // "3" is the no-project audit-only fallback.
-    if (isAuditChoice(choice)) {
-        return configureAuditOnly(binName);
-    }
-    if (isLocalChoice(choice)) {
-        return configureLocalStack(binName, harness, ctx);
-    }
-    return configureNetwork(binName, harness, ctx);
-}
-function configureAuditOnly(binName) {
-    (0, config_js_1.saveConfig)({ auditOnly: true });
-    ui.heading("Audit-only mode");
-    ui.success("Configured for local / audit-only mode.");
-    ui.hint("Tool calls are traced locally; no Ory project, auth, or permission checks.");
-    ui.summary([["Config", (0, config_js_1.getConfigPath)()]]);
-    ui.blank();
-    ui.hint(`To connect to Ory later, re-run install with ${ui.inlineCommand("--reconfigure")}, or run:`);
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --project-url <URL> --oauth2-client-id <CLIENT_ID>`);
-    return { outcome: "audit_only" };
-}
-/**
- * Configure the plugin against the local Ory stack. Every value the plugin
- * needs — the project URL (`http://localhost:4000`), the public OAuth2 client
- * for the PKCE login (the seeded `ory-user-local`), and the tool permissions —
- * is supplied by the stack itself, so this path takes **no** prompts: the local
- * stack is the default source of otherwise-unprovided values.
- *
- * The flow brings the stack up (idempotent; Docker required), seeds the test
- * identity + `use` permissions, persists the local connection details, and runs
- * the login + agent DCR so the next session is fully wired. Every step is
- * fail-open: if Docker isn't available we still persist the local config and
- * tell the user to run `local up` when they can, so the plugin is pointed at
- * the local stack either way.
- */
-async function configureLocalStack(binName, harness, ctx) {
-    const bringUp = ctx.deps.localStackFn ?? index_js_1.ensureLocalOryStack;
-    const seed = ctx.deps.seedFn ?? index_js_1.seedLocalEnvironment;
-    ui.heading("Local Ory stack");
-    ui.step("Setting up the local Ory stack (Kratos, Keto, Hydra, gateway on :4000).");
-    ui.hint("This requires Docker and may take a minute on first run.");
-    let stackStatus;
-    let stackDetail;
-    try {
-        const stack = await bringUp();
-        stackStatus = stack.status;
-        stackDetail = stack.detail;
-    }
-    catch (err) {
-        stackStatus = "compose-failed";
-        stackDetail = err instanceof Error ? err.message : String(err);
-    }
-    const running = stackStatus === "started" || stackStatus === "already-running";
-    // Point the plugin at the local stack regardless of whether it came up: the
-    // seeded PKCE client id is stable, so this config is valid the moment the
-    // stack is running (now, or after a later `local up`). Persist the seeded
-    // subject namespace too so permission checks address the user as the same
-    // SubjectSet (`User:<id>`) the seed writes — without it, enforce mode would
-    // never match the seeded tuples.
-    (0, config_js_1.saveConfig)({
-        projectUrl: index_js_1.GATEWAY_URL,
-        oauth2ClientId: index_js_1.USER_CLIENT_ID,
-        userSubjectNamespace: index_js_1.USER_SUBJECT_NAMESPACE,
-        userLogin: true,
-        auditOnly: false,
-    });
-    if (!running) {
-        console.warn("");
-        ui.warning(`Could not start the local stack: ${stackDetail ?? stackStatus}.`);
-        ui.warnDetail("The plugin is still configured for the local stack — start it when Docker is ready:");
-        ui.warnDetail(`${(0, cli_invocation_js_1.oryNpx)(binName)} local up`);
-        printLocalStackSummary();
-        return {
-            outcome: "local_configured",
-            projectUrl: index_js_1.GATEWAY_URL,
-            oauth2ClientId: index_js_1.USER_CLIENT_ID,
-            userAuthenticated: false,
-            // The stack seeds its own permissions on `local up`; never run the
-            // hosted-project admin bootstrap against localhost.
-            skipAutoBootstrap: true,
-        };
-    }
-    // Seed the identity + `use` permissions into the local stack. Best-effort:
-    // observe mode (the install default) keeps tools working even if this fails.
-    let credentials = null;
-    try {
-        const result = await seed();
-        credentials = {
-            email: result.user.identity.email,
-            password: result.user.password,
-        };
-        ui.success(`Seeded ${result.permissions.tuples} permissions in '${result.permissions.namespace}' for ${result.permissions.subject}.`);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        ui.warning(`Could not seed the local stack: ${msg}`);
-        ui.warnDetail(`Seed it later with: ${(0, cli_invocation_js_1.oryNpx)(binName)} local seed`);
-    }
-    printLocalStackSummary();
-    if (credentials) {
-        ui.heading("Sign in to the browser login with the seeded test user:");
-        ui.summary([
-            ["Email", credentials.email],
-            ["Password", credentials.password],
-        ]);
-    }
-    const { authenticated } = await completeFullSetup(binName, harness, ctx);
-    return {
-        outcome: "local_configured",
-        projectUrl: index_js_1.GATEWAY_URL,
-        oauth2ClientId: index_js_1.USER_CLIENT_ID,
-        userAuthenticated: authenticated,
-        skipAutoBootstrap: true,
-    };
-}
-function printLocalStackSummary() {
-    ui.heading("Local stack configured:");
-    ui.summary([
-        ["Project URL", index_js_1.GATEWAY_URL],
-        ["OAuth2 client id", index_js_1.USER_CLIENT_ID],
-        ["Subject namespace", `${index_js_1.USER_SUBJECT_NAMESPACE} (matches seeded permissions)`],
-        ["Config", (0, config_js_1.getConfigPath)()],
-    ]);
-}
-async function configureNetwork(binName, harness, ctx) {
-    const { prompt } = ctx;
-    // 1. Ensure the `ory` CLI is available — offer to install it if it isn't,
-    //    so a from-scratch user (no CLI on PATH) doesn't dead-end here. On accept
-    //    we install `@ory/cli` into a plugin-managed dir and switch the runner to
-    //    the freshly installed binary; on decline/failure we fall back to manual.
-    let runner = ctx.runner;
-    if (!oryCliPresent(runner)) {
-        const installed = await maybeInstallOryCli(ctx, prompt);
-        if (!installed) {
-            printOryCliMissing();
-            printManualSetup(binName);
-            return { outcome: "network_fallback" };
-        }
-        runner = installed;
-    }
-    // 2. Ensure the user is signed in. `ory` persists its own session, so probe
-    //    first (listing workspaces) and only launch the browser sign-in when the
-    //    probe fails — otherwise we'd promise a browser that never opens because
-    //    the user is already authenticated.
-    let wsList = runner.exec(["list", "workspaces", "--format", "json"]);
-    if (wsList.status !== 0) {
-        ui.heading("Sign in to Ory Network");
-        ui.info("A browser window will open to sign in or create an account.");
-        ui.hint("If it doesn't, watch this terminal for a URL to open manually.");
-        ui.hint("The browser handles sign-in only — this terminal drives the rest of setup,");
-        ui.hint("so once the browser says you're signed in, come back here to continue.");
-        const loginCode = ctx.runInteractive(() => runner.execInteractive(["auth"]));
-        // The `ory auth` browser page is rendered by the Ory CLI, so we can't tell
-        // the user there to return to the terminal. Ring the bell instead — their
-        // focus is still on the browser, and this pulls it back to the terminal
-        // (dock bounce / tab badge) where the next steps live.
-        ui.bell();
-        if (loginCode !== 0) {
-            console.warn("");
-            ui.warning("Ory Network sign-in did not complete.");
-            printManualSetup(binName);
-            return { outcome: "network_fallback" };
-        }
-        ui.success("Signed in to Ory Network — back in the terminal now.");
-        ui.step("Next, choose your workspace and project here. Loading your workspaces…");
-        wsList = runner.exec(["list", "workspaces", "--format", "json"]);
-    }
-    else {
-        ui.heading("Ory Network");
-        ui.success("Already signed in to Ory Network.");
-    }
-    // 3. Pick a workspace (offer to create one when the account has none — a
-    //    brand-new account may have no workspace yet).
-    let workspaces = wsList.status === 0 ? parseList(wsList.stdout, "workspaces") : null;
-    if (!workspaces || workspaces.length === 0) {
-        const created = await maybeCreateWorkspace(runner, prompt, harness);
-        if (created)
-            workspaces = [created];
-    }
-    if (!workspaces || workspaces.length === 0) {
-        console.warn("");
-        ui.warning("No Ory Network workspace selected.");
-        ui.warnDetail("Create one at https://console.ory.sh/ and re-run install with --reconfigure.");
-        printManualSetup(binName);
-        return { outcome: "network_fallback" };
-    }
-    const workspace = await selectFromList(prompt, "workspace", workspaces, (w) => w.name ?? w.id);
-    if (!workspace) {
-        printManualSetup(binName);
-        return { outcome: "network_fallback" };
-    }
-    // 4. Pick a project. A brand-new workspace with none gets the create prompt;
-    //    otherwise the existing projects are listed for selection, and while the
-    //    workspace is still under the Developer-plan cap of two we also offer to
-    //    create a fresh project dedicated to the agent plugin — so a single-project
-    //    account isn't forced to reuse its existing project.
-    ui.step("Loading projects…");
-    const existingProjects = listProjects(runner, workspace.id);
-    const project = !existingProjects || existingProjects.length === 0
-        ? await maybeCreateProject(runner, prompt, workspace, harness)
-        : await selectOrCreateProject(runner, prompt, workspace, harness, existingProjects);
-    if (!project) {
-        console.warn("");
-        ui.warning("No Ory Network project selected.");
-        printManualSetup(binName);
-        return { outcome: "network_fallback" };
-    }
-    // The SDK URL is built from the project *slug*. Require a real slug — a
-    // missing one, or a value that looks like the project id (UUID), can't
-    // produce a correct URL, so fall back to manual setup rather than guess.
-    if (!project.slug || (0, config_js_1.looksLikeProjectId)(project.slug)) {
-        console.warn("");
-        ui.warning("Could not resolve the selected project's slug (needed for the SDK URL).");
-        printManualSetup(binName);
-        return { outcome: "network_fallback" };
-    }
-    const projectUrl = projectUrlFromSlug(project.slug);
-    // 5. Enable OAuth2 Dynamic Client Registration so the agent identity can
-    //    self-register at runtime. Ory Network projects ship with DCR disabled,
-    //    so without this the default agent-identity path would never resolve.
-    await maybeEnableDcr(runner, prompt, project.id);
-    // 6. Provision the public OAuth2 client for the PKCE user login. Reuse an
-    //    existing one on this project first — a re-run (`install --reconfigure`)
-    //    against the same project must not mint a duplicate public client and
-    //    orphan the old one (the CLI-created client is never cleaned up by
-    //    uninstall). Only create when no prior client is found.
-    ui.heading("OAuth2 client");
-    let clientId = findExistingOAuth2Client(runner, project.id);
-    if (clientId) {
-        ui.step(`Reusing the existing OAuth2 client for user login (${clientId}).`);
-    }
-    else {
-        ui.step("Creating the OAuth2 client for user login...");
-        clientId = createOAuth2Client(runner, project.id);
-    }
-    if (!clientId) {
-        ui.warning("Could not create the OAuth2 client automatically.");
-        ui.warnDetail(`Project URL resolved: ${projectUrl}`);
-        printManualOAuth2ClientHelp(binName, project.id);
-        // Still persist the project URL + id so the user only needs the client id.
-        (0, config_js_1.saveConfig)({ projectUrl, projectId: project.id, auditOnly: false });
-        return { outcome: "network_fallback", projectUrl };
-    }
-    // 7. Persist and enable user login. The project id is stored alongside the
-    //    URL (it's the `ORY_PROJECT_ID` value) so later admin operations and
-    //    `status` have it without re-selecting a project.
-    (0, config_js_1.saveConfig)({
-        projectUrl,
-        projectId: project.id,
-        oauth2ClientId: clientId,
-        userLogin: true,
-        auditOnly: false,
-    });
-    ui.heading("Ory Network connected:");
-    ui.success("Project connected and OAuth2 client created.");
-    ui.summary([
-        ["Project URL", projectUrl],
-        ["OAuth2 client id", clientId],
-        ["Config", (0, config_js_1.getConfigPath)()],
-    ]);
-    // 8. Best-effort full setup: log the user in now and resolve the agent
-    //    identity, so the very next session is fully wired.
-    const { authenticated, subject } = await completeFullSetup(binName, harness, ctx);
-    // 9. Bootstrap permissions via the admin-authenticated `ory` CLI. The
-    //    runtime agent/user tokens can't write relation tuples on a hosted
-    //    project (that's a project-admin operation), but the `ory` session can.
-    if (subject) {
-        // Persist the subject *shape* this grant used. If the install resolved a
-        // SubjectSet (ORY_USER_SUBJECT_NAMESPACE was set), a later runtime session
-        // that lacks the env var would otherwise resolve a direct subject_id and
-        // check/write a divergent tuple for the same user. Persisting the namespace
-        // keeps install-time and runtime writes on one canonical subject shape.
-        if ("subjectSet" in subject) {
-            (0, config_js_1.saveConfig)({ userSubjectNamespace: subject.subjectSet.namespace });
-        }
-        await bootstrapPermissionsViaOry(runner, project.id, harness, subject, prompt);
-    }
-    // 10. Provision the project API key runtime permission *checks* need. Same
-    //     root cause as bootstrap's admin path — the DCR OAuth2 token can't
-    //     authenticate Ory Network's Permission API — but this credential is used
-    //     at runtime, so it's persisted to config. Placed last so its prompt
-    //     doesn't consume answers meant for earlier steps.
-    await maybeProvisionProjectApiKey(binName, harness, project.id, projectUrl, prompt, ctx.deps.createProjectApiKeyFn ?? createProjectApiKeyViaConsole, ctx.deps.validateApiKeyFn ?? apiKeyAuthenticates);
-    return {
-        outcome: "network_configured",
-        projectUrl,
-        oauth2ClientId: clientId,
-        userAuthenticated: authenticated,
-        // We just handled bootstrap with admin scope; don't let runPostInstall
-        // retry it with the scope-less DCR token (which would only 403).
-        skipAutoBootstrap: true,
-    };
-}
-async function completeFullSetup(binName, harness, ctx) {
-    const clientFactory = ctx.deps.clientFactory ?? client_js_1.OryAgentClient.fromEnv;
-    const userLogin = ctx.deps.userLoginFn ?? user_login_js_1.ensureUserAuthenticated;
-    const agentGate = ctx.deps.agentGateFn ?? agent_auth_js_1.ensureAgentIdentity;
-    try {
-        const client = clientFactory(harness);
-        ui.heading("Signing you in to the project as the permission subject.");
-        ui.hint("If a sign-in is needed, a browser will open (watch for a URL here too).");
-        const decision = await userLogin(client, {
-            binName,
-            harness,
-            allowBlock: false,
-        });
-        // Resolve the agent identity regardless — it bootstraps from the user
-        // token when present and no-ops otherwise. Never blocks.
-        await agentGate(client, { harness });
-        const authenticated = decision.proceed && !!decision.subject;
-        const subject = authenticated ? (0, subject_js_1.resolveUserSubject)(client) : null;
-        return {
-            authenticated,
-            subject: subject && (0, subject_js_1.subjectLabel)(subject) !== "agent:unknown" ? subject : null,
-        };
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        ui.warning(`Skipping automatic login (will run on first session): ${msg}`);
-        return { authenticated: false, subject: null };
-    }
-}
-/**
- * Grant the signed-in user `use` on every built-in tool by writing relation
- * tuples through the admin-authenticated `ory` CLI (`ory create
- * relationships`). This is the one credential in the flow with project-admin
- * scope — the agent's DCR token and the user's PKCE token can't write tuples
- * on a hosted Ory Network project.
- *
- * The tuples reference the permission namespace (default `AgentTools`), which
- * must be defined in the project's permission model or the write fails with
- * `NotFound`. So we inspect the model first (see {@link inspectPermissionModel})
- * and act on what's actually there. We provision in every case *except* when
- * the namespace already exists:
- *
- *   - **Namespace already defined** → grant directly, touch nothing.
- *   - **No model yet** (a freshly created Ory Network project) → offer to
- *     provision a minimal `<namespace>` model (`ory update opl`), then grant.
- *   - **Model exists (OPL source fetchable) but lacks `<namespace>`** → offer
- *     to *merge* the namespace into the existing OPL and re-upload it, leaving
- *     the other namespaces untouched, then grant. Ory Network serves the OPL
- *     source at a `location` URL in the permission config, which makes this
- *     non-destructive merge possible.
- *   - **Model provably exists but its source couldn't be read** → we can't
- *     merge and `ory update opl` overwrites the whole OPL, so we refuse to
- *     clobber it: print the exact snippet to add and skip the grant.
- *
- * Best-effort throughout: any failure prints a short, actionable note rather
- * than a wall of errors. Observe mode (the install default) keeps tools working
- * regardless, so this is an optimization, not a hard requirement.
- */
-async function bootstrapPermissionsViaOry(runner, projectId, harness, subject, prompt) {
-    const namespace = process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-    const tools = (0, tool_catalog_js_1.getToolCatalog)(harness);
-    if (tools.length === 0)
-        return;
-    // Ensure the namespace the tuples reference exists, or the write NotFounds.
-    // We only skip provisioning when the namespace is already defined; every
-    // other state provisions. When we can fetch the existing OPL source we merge
-    // our namespace into it (non-destructive); otherwise we create a fresh
-    // minimal model. The one case we refuse is a model that provably exists but
-    // whose source we couldn't read — overwriting it would clobber it.
-    const model = await inspectPermissionModel(runner, projectId, namespace);
-    if (model.kind === "merge") {
-        // A model exists and we have its OPL source — append our namespace without
-        // disturbing the others (prompted).
-        ui.heading(`This project has a permission model, but it doesn't define '${namespace}'.`);
-        ui.hint("It can be added to the existing model without changing the other namespaces.");
-        ui.blank();
-        const answer = await prompt(ui.promptLine(`Add '${namespace}' to this project's permission model now?`, {
-            hint: "[Y/n]",
-        }));
-        if (isNo(answer)) {
-            printPermissionModelHelp(namespace);
-            return;
-        }
-        if (!provisionPermissionModel(runner, projectId, namespace, model.opl)) {
-            ui.warning(`Could not add '${namespace}' to the permission model automatically.`);
-            printPermissionModelHelp(namespace);
-            return;
-        }
-        ui.success(`Added '${namespace}' to the permission model.`);
-    }
-    else if (model.kind === "empty" || model.kind === "unknown") {
-        // No model (or one we couldn't read at all) — provision a minimal one
-        // (prompted). Reading the config failing is treated as "nothing there".
-        ui.heading(`This project has no '${namespace}' permission model yet —`);
-        ui.hint("without it, permission checks can't be granted or enforced.");
-        ui.blank();
-        const answer = await prompt(ui.promptLine(`Create a minimal '${namespace}' permission model on this project now?`, { hint: "[Y/n]" }));
-        if (isNo(answer)) {
-            printPermissionModelHelp(namespace);
-            return;
-        }
-        if (!provisionPermissionModel(runner, projectId, namespace)) {
-            ui.warning(`Could not create the '${namespace}' permission model automatically.`);
-            printPermissionModelHelp(namespace);
-            return;
-        }
-        ui.success(`Created the '${namespace}' permission model.`);
-    }
-    else if (model.kind === "blocked") {
-        // A model provably exists but we couldn't fetch its source, so we can't
-        // merge and `ory update opl` would overwrite it. Guide instead of clobber.
-        ui.heading(`This project has a permission model, but it doesn't define '${namespace}'`);
-        ui.hint("and its source couldn't be read, so adding it automatically might overwrite it.");
-        printPermissionModelHelp(namespace);
-        return;
-    }
-    // "present" (namespace already defined) falls through and grants directly.
-    const subjectPatch = "subjectSet" in subject
-        ? {
-            subject_set: {
-                namespace: subject.subjectSet.namespace,
-                object: subject.subjectSet.object,
-                relation: subject.subjectSet.relation,
-            },
-        }
-        : { subject_id: subject.subjectId };
-    const tuples = tools.map((object) => ({
-        namespace,
-        object,
-        relation: "use",
-        ...subjectPatch,
-    }));
-    ui.heading("Permissions");
-    ui.step(`Granting ${(0, subject_js_1.subjectLabel)(subject)} 'use' on ${tools.length} tools (via the Ory CLI)...`);
-    const r = runner.exec(["create", "relationships", "--project", projectId, "--format", "json", "-f", "-", "--yes"], { input: JSON.stringify(tuples) });
-    if (r.status === 0) {
-        ui.success(`Granted permissions for ${tools.length} tools in '${namespace}'.`);
-        return;
-    }
-    ui.warning("Could not pre-grant permissions automatically.");
-    const detail = r.stderr.trim();
-    if (detail)
-        ui.warnDetail(detail.split("\n")[0]);
-    printPermissionModelHelp(namespace);
-}
-/**
- * Inspect the project's permission model. Ory Network reports the config in one
- * of two shapes: `{ namespaces: [] }` (or `null`) for a project with no model,
- * and `{ namespaces: { location: "https://….txt" } }` for an OPL-configured
- * one — where the `.txt` is the full OPL *source*. We fetch that source so a
- * missing namespace can be merged in rather than clobbering the whole model.
- */
-async function inspectPermissionModel(runner, projectId, namespace) {
-    const r = runner.exec([
-        "get",
-        "permission-config",
-        "--project",
-        projectId,
-        "--format",
-        "json",
-    ]);
-    if (r.status !== 0)
-        return { kind: "unknown" };
-    const cfg = safeJsonParse(r.stdout);
-    if (!cfg || typeof cfg !== "object")
-        return { kind: "unknown" };
-    const ns = cfg.namespaces;
-    // A fresh project reports no model as null / an absent key.
-    if (ns == null)
-        return { kind: "empty" };
-    // OPL-configured form: { namespaces: { location: "https://….txt" } }.
-    // The .txt holds the full OPL source, so we can merge into it.
-    if (!Array.isArray(ns) && typeof ns === "object") {
-        const location = ns.location;
-        if (typeof location !== "string" || !location)
-            return { kind: "empty" };
-        const opl = await fetchOplSource(location);
-        // A model exists but its source is unreadable — can't merge, mustn't clobber.
-        if (opl == null)
-            return { kind: "blocked" };
-        return oplDefinesClass(opl, namespace)
-            ? { kind: "present" }
-            : { kind: "merge", opl };
-    }
-    // Inline compiled form: { namespaces: [{ name, id }, …] } (legacy / self-hosted).
-    // We only have names, not source, so a missing namespace can't be merged.
-    if (Array.isArray(ns)) {
-        if (ns.length === 0)
-            return { kind: "empty" };
-        const names = ns
-            .map((n) => n && typeof n === "object"
-            ? n.name
-            : undefined)
-            .filter((n) => typeof n === "string");
-        return names.includes(namespace) ? { kind: "present" } : { kind: "blocked" };
-    }
-    return { kind: "unknown" };
-}
-/** Fetch the OPL source served at a permission-config `location` URL. */
-async function fetchOplSource(url) {
-    try {
-        const res = await fetch(url);
-        if (!res.ok)
-            return null;
-        return await res.text();
-    }
-    catch {
-        return null;
-    }
-}
-/** Whether an OPL source defines `class <name>`. */
-function oplDefinesClass(opl, name) {
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return new RegExp(`\\bclass\\s+${escaped}\\b`).test(opl);
-}
-/**
- * Provision a permission model that defines `<namespace>` with a `use`
- * relation, via `ory update opl`. The namespace becomes an OPL class, so it
- * must be a valid identifier; if not, we bail (caller guides instead).
- *
- * When `existingOpl` is given, the namespace is appended to that source
- * (preserving the model's other namespaces); otherwise a fresh minimal model
- * is generated. Writes the OPL to a temp file because `ory update opl` reads
- * `--file` only (no stdin). Returns true on success.
- */
-function provisionPermissionModel(runner, projectId, namespace, existingOpl) {
-    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(namespace))
-        return false;
-    const opl = existingOpl !== undefined
-        ? mergeNamespaceIntoOpl(existingOpl, namespace)
-        : freshOpl(namespace);
-    let dir;
-    try {
-        dir = fs.mkdtempSync(path.join(os.tmpdir(), "ory-opl-"));
-    }
-    catch {
-        return false;
-    }
-    const file = path.join(dir, "namespace_config.ts");
-    try {
-        fs.writeFileSync(file, opl);
-        const r = runner.exec([
-            "update",
-            "opl",
-            "--project",
-            projectId,
-            "-f",
-            file,
-            "--format",
-            "json",
-            "--yes",
-        ]);
-        return r.status === 0;
-    }
-    catch {
-        return false;
-    }
-    finally {
-        try {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-        catch {
-            /* ignore */
-        }
-    }
-}
-/** A minimal standalone OPL defining `User` and `<namespace>` with `use`. */
-function freshOpl(namespace) {
-    return [
-        'import { Namespace } from "@ory/permission-namespace-types"',
-        "",
-        "class User implements Namespace {}",
-        "",
-        `class ${namespace} implements Namespace {`,
-        "  related: {",
-        "    use: User[]",
-        "  }",
-        "}",
-        "",
-    ].join("\n");
-}
-/**
- * Append a `<namespace>` class (with a `use: User[]` relation) to an existing
- * OPL source, leaving every other namespace untouched. Adds a `User` class too
- * when the source doesn't already define one, since `use` is typed `User[]`.
- */
-function mergeNamespaceIntoOpl(existingOpl, namespace) {
-    let opl = existingOpl.replace(/\s*$/, "\n");
-    if (!oplDefinesClass(opl, "User")) {
-        opl += "\nclass User implements Namespace {}\n";
-    }
-    opl +=
-        `\nclass ${namespace} implements Namespace {\n` +
-            "  related: {\n" +
-            "    use: User[]\n" +
-            "  }\n" +
-            "}\n";
-    return opl;
-}
-function printPermissionModelHelp(namespace) {
-    // When the namespace is a valid OPL class name, show the exact snippet to
-    // paste into the model — that's the concrete "how" behind "define it". The
-    // 'use' relation is typed `User[]`, so `User` is a compile-time dependency:
-    // include it too, since an existing model may not already define it.
-    if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(namespace)) {
-        ui.warnDetail(`Add the '${namespace}' namespace to your Ory Permissions model. Its 'use'`);
-        ui.warnDetail("relation is typed `User[]`, so `User` must be defined too:");
-        console.warn("");
-        console.warn(ui.style.gray("      class User implements Namespace {}"));
-        console.warn("");
-        console.warn(ui.style.gray(`      class ${namespace} implements Namespace {`));
-        console.warn(ui.style.gray("        related: { use: User[] }"));
-        console.warn(ui.style.gray("      }"));
-        console.warn("");
-        ui.warnDetail("(drop the `User` class if your model already defines it), then re-run");
-        ui.warnDetail("install with --reconfigure to grant. You're in observe mode, so tools");
-        ui.warnDetail("keep working meanwhile.");
-        return;
-    }
-    ui.warnDetail(`Define the '${namespace}' namespace in Ory Permissions, then re-run install`);
-    ui.warnDetail("with --reconfigure to grant. You're in observe mode, so tools keep working.");
-}
-// ─── ory CLI helpers ──────────────────────────────────────────────────────
-function oryCliPresent(runner) {
-    return runner.exec(["version"]).status === 0;
-}
-/**
- * The `ory` binary isn't on `PATH`. Offer (prompted, default yes) to install it
- * automatically so the Ory Network path doesn't dead-end for a from-scratch
- * user. On accept, install `@ory/cli` into a plugin-managed dir and return a
- * runner bound to it; on decline or failure, return null so the caller falls
- * back to the manual instructions. Never throws.
- */
-async function maybeInstallOryCli(ctx, prompt) {
-    ui.heading("Ory CLI");
-    ui.info("Connecting to Ory Network needs the Ory CLI, which isn't installed yet.");
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Install it now (via npm, no system changes)?", { hint: "[Y/n]" }));
-    if (isNo(answer))
-        return null;
-    ui.step(`Installing ${exports.ORY_CLI_NPM_SPEC} — this can take a moment...`);
-    const install = ctx.deps.installOryCliFn ?? installOryCli;
-    let runner;
-    try {
-        runner = await install();
-    }
-    catch {
-        runner = null;
-    }
-    if (!runner) {
-        ui.warning("Could not install the Ory CLI automatically.");
-        return null;
-    }
-    ui.success("Ory CLI installed.");
-    return runner;
-}
-function listProjects(runner, workspaceId) {
-    const r = runner.exec([
-        "list",
-        "projects",
-        "--workspace",
-        workspaceId,
-        "--format",
-        "json",
-    ]);
-    if (r.status !== 0)
-        return null;
-    return parseList(r.stdout, "projects");
-}
-async function maybeCreateWorkspace(runner, prompt, harness) {
-    ui.heading("Your Ory Network account has no workspaces yet.");
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Create a new workspace now?", { hint: "[Y/n]" }));
-    if (isNo(answer))
-        return null;
-    const defaultName = `${harness}-workspace`;
-    const nameInput = await prompt(ui.promptLine("Workspace name", { hint: `[${defaultName}]` }));
-    const name = nameInput && nameInput.length > 0 ? nameInput : defaultName;
-    const r = runner.exec([
-        "create",
-        "workspace",
-        "--name",
-        name,
-        "--format",
-        "json",
-        "--yes",
-    ]);
-    if (r.status !== 0) {
-        ui.warning(`Could not create the workspace: ${r.stderr.trim() || "unknown error"}`);
-        return null;
-    }
-    const workspace = parseObject(r.stdout);
-    if (!workspace || !workspace.id)
-        return null;
-    ui.success(`Created workspace "${workspace.name ?? name}".`);
-    return workspace;
-}
-async function maybeCreateProject(runner, prompt, workspace, harness) {
-    const wsLabel = workspace.name ?? workspace.id;
-    ui.heading(`Workspace "${wsLabel}" has no projects yet.`);
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Create a new project now?", { hint: "[Y/n]" }));
-    if (isNo(answer))
-        return null;
-    return createProjectInteractive(runner, prompt, workspace, harness);
-}
-/**
- * Choose the project to wire up when the workspace already has at least one.
- * Lists the existing projects for selection and — while the workspace is still
- * under the Ory Network Developer-plan cap of two projects — offers a "create a
- * new project" option, so an account with a single project can dedicate a fresh
- * one to the agent plugin instead of being forced onto the existing project.
- * Returns null if the user cancels.
- */
-async function selectOrCreateProject(runner, prompt, workspace, harness, projects) {
-    // Developer plans cap a workspace at two projects; only offer to create while
-    // there's still headroom.
-    const PROJECT_CAP = 2;
-    const canCreate = projects.length < PROJECT_CAP;
-    ui.heading("Select a project:");
-    ui.blank();
-    const entries = projects.map((p, i) => ({
-        key: String(i + 1),
-        label: `${p.name ?? p.slug ?? p.id}${p.slug ? ` (${p.slug})` : ""}`,
-    }));
-    if (canCreate) {
-        entries.push({
-            key: String(projects.length + 1),
-            label: "Create a new project for the agent plugin",
-        });
-    }
-    ui.menu(entries);
-    ui.blank();
-    for (let attempt = 0; attempt < 3; attempt++) {
-        const answer = await prompt(ui.promptLine("Enter a number", { hint: `[1-${entries.length}]` }));
-        if (answer === null || answer.trim() === "")
-            return null;
-        const n = Number.parseInt(answer.trim(), 10);
-        if (Number.isInteger(n) && n >= 1 && n <= projects.length) {
-            return projects[n - 1];
-        }
-        if (canCreate && n === projects.length + 1) {
-            return createProjectInteractive(runner, prompt, workspace, harness);
-        }
-        ui.warning(`"${answer}" is not a valid choice.`);
-    }
-    return null;
-}
-/**
- * Prompt for a project name (defaulting to `<harness>-agent`) and create it in
- * the given workspace. Shared by the empty-workspace path and the "create a new
- * project" menu option. Returns null on failure.
- */
-async function createProjectInteractive(runner, prompt, workspace, harness) {
-    const defaultName = `${harness}-agent`;
-    const nameInput = await prompt(ui.promptLine("New project name", { hint: `[${defaultName}]` }));
-    const name = nameInput && nameInput.length > 0 ? nameInput : defaultName;
-    const r = runner.exec([
-        "create",
-        "project",
-        "--name",
-        name,
-        "--workspace",
-        workspace.id,
-        "--format",
-        "json",
-        "--yes",
-    ]);
-    if (r.status !== 0) {
-        ui.warning(`Could not create the project: ${r.stderr.trim() || "unknown error"}`);
-        return null;
-    }
-    const project = parseObject(r.stdout);
-    if (!project || !project.id)
-        return null;
-    ui.success(`Created project "${project.name ?? name}".`);
-    return project;
-}
-/** JSON-Patch path (relative to the oauth2 service config) that toggles DCR. */
-const DCR_ENABLED_PATH = "/oidc/dynamic_client_registration/enabled";
-/**
- * Read the project's current DCR state via `ory get oauth2-config`.
- * Returns `true`/`false` when the value is known, or `null` when it can't be
- * determined (CLI error, unparseable output) so the caller falls open and
- * prompts anyway rather than assuming a state.
- */
-function dcrEnabled(runner, projectId) {
-    const r = runner.exec([
-        "get",
-        "oauth2-config",
-        "--project",
-        projectId,
-        "--format",
-        "json",
-    ]);
-    if (r.status !== 0)
-        return null;
-    const config = parseObject(r.stdout);
-    if (!config)
-        return null;
-    const enabled = config.oidc?.dynamic_client_registration?.enabled;
-    return typeof enabled === "boolean" ? enabled : null;
-}
-/**
- * Enable OAuth2 Dynamic Client Registration on the project so the agent
- * identity can self-register (RFC 7591) at runtime. First probes the project's
- * current DCR state and skips silently when it's already enabled. Otherwise
- * prompts (default yes) since it changes project-wide config; best-effort and
- * fail-open — a decline or failure just prints the manual command and continues.
- */
-async function maybeEnableDcr(runner, prompt, projectId) {
-    if (dcrEnabled(runner, projectId) === true)
-        return;
-    ui.heading("Dynamic Client Registration");
-    ui.info("The agent identity registers itself via OAuth2 Dynamic Client Registration");
-    ui.hint("(DCR), which Ory Network projects disable by default.");
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Enable Dynamic Client Registration on this project?", { hint: "[Y/n]" }));
-    const manual = `ory patch oauth2-config --project ${projectId} --replace '${DCR_ENABLED_PATH}=true'`;
-    if (isNo(answer)) {
-        ui.hint("Skipped. Enable it later with:");
-        ui.command(manual);
-        ui.hint("or supply static agent credentials (ORY_AGENT_CLIENT_ID + ORY_AGENT_CLIENT_SECRET).");
-        return;
-    }
-    const r = runner.exec([
-        "patch",
-        "oauth2-config",
-        "--project",
-        projectId,
-        "--replace",
-        `${DCR_ENABLED_PATH}=true`,
-        "--format",
-        "json",
-        "--yes",
-    ]);
-    if (r.status === 0) {
-        ui.success("Dynamic Client Registration enabled.");
-    }
-    else {
-        ui.warning(`Could not enable DCR automatically: ${r.stderr.trim() || "unknown error"}`);
-        ui.warnDetail(`Enable it later with: ${manual}`);
-    }
-}
-/** The `client_name` every plugin-provisioned public PKCE client carries. */
-const OAUTH2_CLIENT_NAME = "ory-agent-plugin";
-/**
- * Look for an already-provisioned public PKCE client on the project so a
- * re-run reuses it instead of minting a duplicate. Matches by the fixed
- * `client_name` {@link createOAuth2Client} assigns. Best-effort: any CLI or
- * parse failure returns null and the caller falls back to creating one.
- */
-function findExistingOAuth2Client(runner, projectId) {
-    const r = runner.exec([
-        "list",
-        "oauth2-clients",
-        "--project",
-        projectId,
-        "--format",
-        "json",
-    ]);
-    if (r.status !== 0)
-        return null;
-    const clients = parseList(r.stdout, "items");
-    if (!clients)
-        return null;
-    const match = clients.find((c) => c.client_name === OAUTH2_CLIENT_NAME && c.client_id);
-    return match?.client_id ?? null;
-}
-function createOAuth2Client(runner, projectId) {
-    const args = [
-        "create",
-        "oauth2-client",
-        "--project",
-        projectId,
-        "--name",
-        OAUTH2_CLIENT_NAME,
-        "--grant-type",
-        "authorization_code,refresh_token",
-        "--response-type",
-        "code",
-        "--scope",
-        "openid,offline_access",
-        "--token-endpoint-auth-method",
-        "none",
-        "--format",
-        "json",
-        "--yes",
-    ];
-    for (const uri of exports.LOOPBACK_REDIRECT_URIS) {
-        args.push("--redirect-uri", uri);
-    }
-    const r = runner.exec(args);
-    if (r.status !== 0)
-        return null;
-    const client = parseObject(r.stdout);
-    return client?.client_id ?? null;
-}
-// ─── parsing helpers ────────────────────────────────────────────────────────
-/**
- * Parse a JSON list from `ory --format json` output. Tolerates both a bare
- * array and the `{ <key>: [...] }` envelope the Console list endpoints use.
- */
-function parseList(stdout, key) {
-    const parsed = safeJsonParse(stdout);
-    if (parsed === null)
-        return null;
-    if (Array.isArray(parsed))
-        return parsed;
-    if (typeof parsed === "object") {
-        const value = parsed[key];
-        if (Array.isArray(value))
-            return value;
-    }
-    return null;
-}
-function parseObject(stdout) {
-    const parsed = safeJsonParse(stdout);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        return parsed;
-    }
-    return null;
-}
-function safeJsonParse(stdout) {
-    const trimmed = stdout.trim();
-    if (!trimmed)
-        return null;
-    try {
-        return JSON.parse(trimmed);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Derive the canonical Ory Network project SDK/API URL from a project **slug**.
- * The subdomain is always the slug — never the project id. A project id (a
- * UUID) reaching here means a slug and an id were confused upstream, which
- * would build a URL that points nowhere, so we refuse it loudly rather than
- * silently misconfigure the plugin.
- */
-function projectUrlFromSlug(slug) {
-    if ((0, config_js_1.looksLikeProjectId)(slug)) {
-        throw new Error(`Refusing to build an SDK URL from "${slug}": that is a project id (UUID), not a slug.`);
-    }
-    return `https://${slug}.projects.oryapis.com`;
-}
-// ─── prompt helpers ─────────────────────────────────────────────────────────
-/**
- * Present a numbered list and prompt for a selection. Auto-selects when there
- * is exactly one item. Returns null if the user cancels or gives up.
- */
-async function selectFromList(prompt, label, items, render) {
-    if (items.length === 1) {
-        ui.info(`Using the only ${label}: ${ui.style.bold(render(items[0]))}`);
-        return items[0];
-    }
-    ui.heading(`Select a ${label}:`);
-    ui.blank();
-    ui.menu(items.map((item, i) => ({ key: String(i + 1), label: render(item) })));
-    ui.blank();
-    for (let attempt = 0; attempt < 3; attempt++) {
-        const answer = await prompt(ui.promptLine("Enter a number", { hint: `[1-${items.length}]` }));
-        if (answer === null || answer.trim() === "")
-            return null;
-        const n = Number.parseInt(answer.trim(), 10);
-        if (Number.isInteger(n) && n >= 1 && n <= items.length) {
-            return items[n - 1];
-        }
-        ui.warning(`"${answer}" is not a valid choice.`);
-    }
-    return null;
-}
-function isLocalChoice(answer) {
-    if (answer === null)
-        return false;
-    const v = answer.trim().toLowerCase();
-    return v === "2" || v === "local" || v === "local-stack" || v === "localstack";
-}
-function isAuditChoice(answer) {
-    if (answer === null)
-        return false;
-    const v = answer.trim().toLowerCase();
-    return v === "3" || v === "audit" || v === "audit-only";
-}
-function isNo(answer) {
-    if (answer === null)
-        return false;
-    const v = answer.trim().toLowerCase();
-    return v === "n" || v === "no";
-}
-// ─── banners ────────────────────────────────────────────────────────────────
-function printOryCliMissing() {
-    ui.heading("The Ory CLI (`ory`) is required to connect to Ory Network but was not found.");
-    ui.hint("Install it, then re-run install with --reconfigure:");
-    ui.summary([
-        ["macOS/Linux (Homebrew)", "brew install ory/tap/cli"],
-        [
-            "macOS/Linux (script)",
-            "bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) -b . ory",
-        ],
-        ["Docs", "https://www.ory.com/docs/guides/cli/installation"],
-    ]);
-}
-function printManualSetup(binName) {
-    ui.heading("You can connect to Ory at any time:");
-    ui.blank();
-    ui.bullet("Connect to an Ory project (enables auth & permission checks):");
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --project-url <URL> --oauth2-client-id <CLIENT_ID>`);
-    ui.blank();
-    ui.bullet("Or enable audit logging only (no auth or permission checks):");
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --audit-only`);
-    ui.blank();
-    ui.hint(`Config is saved to ${(0, config_js_1.getConfigPath)()} and shared across all agent plugins.`);
-}
-function printManualOAuth2ClientHelp(binName, projectId) {
-    ui.heading("Create the public OAuth2 client by hand, then supply its id:");
-    ui.blank();
-    console.log(ui.style.gray(`  ory create oauth2-client --project ${projectId} \\`));
-    console.log(ui.style.gray(`    --name "ory-agent-plugin" \\`));
-    console.log(ui.style.gray(`    --grant-type authorization_code,refresh_token \\`));
-    console.log(ui.style.gray(`    --response-type code \\`));
-    console.log(ui.style.gray(`    --scope openid,offline_access \\`));
-    console.log(ui.style.gray(`    --token-endpoint-auth-method none \\`));
-    for (const uri of exports.LOOPBACK_REDIRECT_URIS) {
-        console.log(ui.style.gray(`    --redirect-uri ${uri} \\`));
-    }
-    console.log(ui.style.gray(`    --format json`));
-    ui.blank();
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --oauth2-client-id <CLIENT_ID>`);
-}
-/** Ory Console API base. The `ory` CLI has no project-API-key command, so key
- *  provisioning talks to the Console API directly, authenticated with the CLI's
- *  stored Ory Network session. Override with `ORY_CONSOLE_API_URL`. */
-const CONSOLE_API_URL = process.env.ORY_CONSOLE_API_URL?.trim() || "https://api.console.ory.sh";
-/** Path to the session the `ory` CLI persists after `ory auth`. */
-const ORY_CLI_SESSION_FILE = ".ory-cloud.json";
-/**
- * Read the Ory Network session bearer the `ory` CLI stores at
- * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
- * no token, or the token has expired. Never throws.
- */
-function readConsoleSessionToken() {
-    try {
-        const raw = fs.readFileSync(path.join(os.homedir(), ORY_CLI_SESSION_FILE), "utf-8");
-        const parsed = JSON.parse(raw);
-        const token = parsed.access_token?.access_token;
-        if (!token)
-            return null;
-        const expiry = parsed.access_token?.expiry;
-        if (expiry) {
-            const expMs = Date.parse(expiry);
-            if (Number.isFinite(expMs) && expMs <= Date.now())
-                return null;
-        }
-        return token;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Mint an Ory Network **project API key** via the Console API
- * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
- * Returns the `ory_pat_…` value, or null on any failure (no session, non-2xx,
- * missing value). Never throws — provisioning is best-effort.
- *
- * This is the one place the wizard reaches past the `ory` CLI to the Console
- * API: the CLI (as of v1.3) exposes no project-API-key command, and Keto
- * permission checks can't authenticate without one.
- */
-async function createProjectApiKeyViaConsole(args) {
-    const token = readConsoleSessionToken();
-    if (!token)
-        return null;
-    try {
-        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({ name: args.name }),
-        });
-        if (!res.ok)
-            return null;
-        const body = (await res.json());
-        return typeof body.value === "string" && body.value.length > 0 ? body.value : null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Best-effort check that an already-stored project API key still authenticates
- * against Keto. Runs one permission check with the key: if it completes (any
- * `allowed` value) the key is valid; an auth rejection (`session_inactive` /
- * `forbidden` / `session_aal2_required`) means it was revoked or deleted, so we
- * return false and the caller re-provisions. Transient failures (network /
- * rate-limit / unknown) return true so we don't re-mint on a blip. Never throws.
- */
-async function apiKeyAuthenticates(apiKey, projectUrl) {
-    try {
-        // Direct construction (no fromEnv) seeds the key as both agent token and
-        // admin key and skips DCR, so the probe uses exactly this key. No trace
-        // file is configured, so nothing is written to disk.
-        const probe = new client_js_1.OryAgentClient({ projectUrl, apiKey, harness: "install-probe" });
-        await probe.checkPermission({
-            namespace: process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools",
-            object: "__ory_agent_key_probe__",
-            relation: "__ory_agent_key_probe__",
-            subjectId: "__ory_agent_key_probe__",
-        });
-        return true;
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === "session_inactive" || code === "forbidden" || code === "session_aal2_required") {
-            return false;
-        }
-        return true;
-    }
-}
-/**
- * Manual fallback steps for the project API key, shown when auto-provisioning
- * is declined or fails. The `configure --api-key` command is the stable part;
- * the Console link is a convenience.
- */
-function printManualApiKeySteps(binName, projectId) {
-    ui.info("Create one in the Ory Console (Project settings → API keys):");
-    ui.command(`https://console.ory.sh/projects/${projectId}/settings`);
-    ui.info("then store it so permission checks authenticate with it:");
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} configure --api-key <ory_pat_…>`);
-    ui.hint("Observe mode works without it; enforce mode needs it to allow tools.");
-}
-/**
- * Provision the project API key that runtime Keto permission checks
- * authenticate with. The agent's DCR OAuth2 token can't — Ory Network rejects
- * it — so `enforce` mode needs a project API key. Best-effort and skippable:
- * offers to mint one via the Console API and persist it, and on decline / no
- * TTY / any failure falls back to manual guidance. No-ops when a key is already
- * configured (env or config file).
- */
-async function maybeProvisionProjectApiKey(binName, harness, projectId, projectUrl, prompt, createFn, validateFn) {
-    const resolved = (0, config_js_1.resolveConfig)();
-    if (resolved.apiKey) {
-        // An operator-set env key is authoritative — never touch it.
-        if (resolved.apiKeySource === "env")
-            return;
-        // A stored (config-file) key that no longer authenticates — revoked or
-        // deleted — must not wedge setup: validate it and re-provision if it's
-        // dead. Presence alone isn't enough (a dangling key still fails at runtime
-        // with session_inactive).
-        if (await validateFn(resolved.apiKey, projectUrl))
-            return;
-        ui.heading("Project API key");
-        ui.warning("The stored project API key is no longer valid (revoked or deleted).");
-    }
-    else {
-        ui.heading("Project API key");
-        ui.info("Runtime permission checks call Ory's Permission API, which authenticates");
-        ui.hint("with a project API key — the agent's OAuth2 token isn't accepted there.");
-        ui.hint("(Observe mode works without it; enforce mode needs it to allow tools.)");
-    }
-    ui.blank();
-    const answer = await prompt(ui.promptLine("Create a project API key now and store it?", { hint: "[Y/n]" }));
-    // `null` = no TTY / cancelled; treat as skip so we never mint without consent.
-    if (answer !== null && !isNo(answer)) {
-        ui.step("Creating a project API key via the Ory Console…");
-        let key = null;
-        try {
-            // Name each key uniquely (harness + host + timestamp) so keys are
-            // distinguishable in the Console and a re-provision never collides with
-            // an existing entry.
-            key = await createFn({ projectId, name: projectApiKeyName(harness) });
-        }
-        catch {
-            key = null;
-        }
-        if (key) {
-            (0, config_js_1.saveConfig)({ apiKey: key });
-            ui.success("Project API key created and stored — permission checks will use it.");
-            return;
-        }
-        ui.warning("Couldn't create a project API key automatically (Console session may be missing or expired).");
-    }
-    printManualApiKeySteps(binName, projectId);
-}
-/** Distinguishable, collision-free label for a provisioned project API key. */
-function projectApiKeyName(harness) {
-    let host = "unknown-host";
-    try {
-        host = os.hostname();
-    }
-    catch {
-        /* keep fallback */
-    }
-    return `ory-agent-plugins ${harness} ${host} ${new Date().toISOString()}`;
-}