@ory/argus 0.14.0 → 1.0.0

package/dist/subject.js

@@ -2,28 +2,45 @@
 /**
  * User-subject resolution for permission checks.
  *
- * Permission checks need a subject reference that matches the form
- * stored in Keto. Two shapes are supported:
+ * Every principal — user, agent, sub-agent — is addressed as a **SubjectSet**
+ * `<namespace>:<object>` (e.g. `User:<UUID>`). This is the form the Ory Console's
+ * *Add relationship* dialog writes, the form the local-stack seed writes, and the
+ * Zanzibar-idiomatic composition point (grant `Role:developer` `use` on a tool and
+ * add principals to the role, rather than fanning out a tuple per subject). It is
+ * the only first-class subject form: Keto does no cross-form expansion, so a check
+ * must match the write shape exactly, and standardizing on one shape removes that
+ * silent-misfire footgun.
  *
- *   - **SubjectSet** — `<namespace>:<object>` (e.g. `User:<UUID>`). This
- *     is the form the Console's *Add relationship* dialog writes, so
- *     dev/demo flows that grant tuples through the UI use it.
- *
- *   - **Direct SubjectID** — opaque string (e.g. `user:<UUID>` or
- *     `session:<id>`). Backward-compatible default when no subject
- *     namespace is configured.
- *
- * The selection is driven by the user-subject namespace: `ORY_USER_SUBJECT_NAMESPACE`
- * takes precedence, then the client's configured `userSubjectNamespace` (persisted
- * in the shared config, e.g. by the local-stack install path). When a namespace is
- * present the resolver builds a SubjectSet using it; otherwise it falls back to the
- * direct SubjectID chain.
+ * The namespace is resolved by precedence: `ORY_USER_SUBJECT_NAMESPACE` (env) →
+ * the client's configured `userSubjectNamespace` (persisted in the shared config)
+ * → the {@link DEFAULT_USER_SUBJECT_NAMESPACE} (`User`). The env/config values now
+ * *override* the default namespace; they are no longer an opt-in switch that
+ * toggles between SubjectSet and a legacy direct SubjectID.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
 exports.runWithUserSubject = runWithUserSubject;
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
+exports.validateSubjectOverride = validateSubjectOverride;
+exports.readAgentSubjectOverride = readAgentSubjectOverride;
+exports.resolveAgentSubject = resolveAgentSubject;
+exports.resolveAgentSessionSubject = resolveAgentSessionSubject;
+exports.resolveSubAgentSubject = resolveSubAgentSubject;
+exports.resolveSubAgentSpawnSubject = resolveSubAgentSpawnSubject;
 const node_async_hooks_1 = require("node:async_hooks");
+/**
+ * Default namespace a resolved user principal is addressed under. The
+ * local-stack seed, the Console *Add relationship* dialog, and the Network OPL
+ * provisioning all use `User`, so it is the out-of-the-box default.
+ */
+exports.DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/** Namespace the agent principal is addressed under (delegation subjects). */
+exports.AGENT_NAMESPACE = "Agent";
+/** Namespace a sub-agent principal is addressed under. */
+exports.SUBAGENT_NAMESPACE = "SubAgent";
+/** Namespace the no-user-identity `session:<id>` fallback is addressed under. */
+exports.SESSION_NAMESPACE = "Session";
 /**
  * Per-async-context user-subject override. Populated by
  * {@link runWithUserSubject} so multi-user server integrations (Vercel AI
@@ -37,7 +54,7 @@ const perCallUserSubject = new node_async_hooks_1.AsyncLocalStorage();
  * client's user principal and the env overrides in
  * {@link resolveUserSubject}. The override only applies within `fn`'s
  * async context, so concurrent calls cannot observe each other's subject.
- * `ORY_USER_SUBJECT_NAMESPACE` SubjectSet shaping still applies.
+ * SubjectSet shaping still applies.
  *
  * A missing/empty `subject` is a no-op: `fn` runs with the normal
  * resolution chain.
@@ -47,6 +64,10 @@ function runWithUserSubject(subject, fn) {
         return fn();
     return perCallUserSubject.run(subject, fn);
 }
+/** Build a SubjectSet ref with an empty relation (a plain subject, not a subject-set expansion). */
+function subjectSet(namespace, object) {
+    return { subjectSet: { namespace, object, relation: "" } };
+}
 /**
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
@@ -54,32 +75,196 @@ function runWithUserSubject(subject, fn) {
  * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
- * Returns a SubjectSet when a user-subject namespace is configured (env or
- * client config) and a concrete subject is available; otherwise a direct
- * SubjectID.
+ * Always returns a SubjectSet. A resolved principal is addressed under the
+ * configured user namespace (`ORY_USER_SUBJECT_NAMESPACE` → client config →
+ * {@link DEFAULT_USER_SUBJECT_NAMESPACE}). A `session:`-prefixed fallback is
+ * addressed under {@link SESSION_NAMESPACE} (`Session:<id>`). Only when nothing
+ * resolves at all do we emit the direct `agent:unknown` sentinel — an error
+ * marker that must never match a stored tuple.
  */
 function resolveUserSubject(client, fallback) {
-    const subject = perCallUserSubject.getStore()
+    const principal = perCallUserSubject.getStore()
         ?? client.userPrincipal.subject
         ?? process.env.ORY_USER_SUBJECT_ID
-        ?? process.env.ORY_AGENT_SUBJECT_ID
-        ?? fallback;
-    const ns = process.env.ORY_USER_SUBJECT_NAMESPACE?.trim() || client.userSubjectNamespace;
-    if (subject && ns) {
-        return {
-            subjectSet: { namespace: ns, object: subject, relation: "" },
-        };
+        // Validated, not read raw: the same value feeds the agent subject, so a
+        // value rejected there must not slip in here (#241).
+        ?? readAgentSubjectOverride();
+    const ns = process.env.ORY_USER_SUBJECT_NAMESPACE?.trim()
+        || client.userSubjectNamespace
+        || exports.DEFAULT_USER_SUBJECT_NAMESPACE;
+    if (principal)
+        return subjectSet(ns, principal);
+    // No principal — use the caller's fallback. A `session:<id>` fallback is
+    // addressed under the Session namespace so it is a well-formed SubjectSet that
+    // could match a Session-scoped grant, rather than being wrapped under `User`.
+    if (fallback) {
+        const colon = fallback.indexOf(":");
+        if (colon > 0 && fallback.slice(0, colon).toLowerCase() === "session") {
+            return subjectSet(exports.SESSION_NAMESPACE, fallback.slice(colon + 1));
+        }
+        return subjectSet(ns, fallback);
     }
-    if (subject)
-        return { subjectId: subject };
     return { subjectId: "agent:unknown" };
 }
 /**
  * Printable label for a `UserSubjectRef`. Used in denial messages and
- * span attributes. SubjectSets render as `<namespace>:<object>`.
+ * activity attributes. SubjectSets render as `<namespace>:<object>`.
  */
 function subjectLabel(ref) {
     return "subjectSet" in ref
         ? `${ref.subjectSet.namespace}:${ref.subjectSet.object}`
         : ref.subjectId;
 }
+// ─── Machine principals (agent / sub-agent) ──────────────────────────
+//
+// The agent's OAuth2 credential is session-scoped: one DCR client per
+// `(projectUrl, harness, session)`, plus one client per typed sub-agent in that
+// session. Sessionless integrations use a reserved persistent slot.
+//
+// The registered client id is the principal root. Session and spawn axes remain
+// available as narrower broker subjects and are appended with `|`:
+//
+//     Agent:<clientId>                             session credential
+//     Agent:<clientId>|<session>                   one run
+//     SubAgent:<clientId>                          typed sub-agent credential
+//     SubAgent:<clientId>|<session>|<type>[|<spawn>]   one spawn
+//
+// Every one of these is computable locally, so a block can be written in the
+// Console against the exact string the plugin will check. Nothing here depends
+// on the broker's node id, which is opaque and server-assigned.
+//
+// See docs/session-identity.md.
+/** Separator between the credential client id and narrower scoping axes. */
+exports.SUBJECT_AXIS_SEPARATOR = "|";
+/**
+ * Join a client id with the derived axes that narrow it. Empty and whitespace-
+ * only axes are dropped rather than producing a trailing separator — a subject
+ * ending in `|` would silently never match a stored relation.
+ */
+function deriveSubject(clientId, ...axes) {
+    return [clientId, ...axes.map((a) => a?.trim()).filter((a) => !!a)].join(exports.SUBJECT_AXIS_SEPARATOR);
+}
+/** The env var that overrides the agent's subject. */
+exports.AGENT_SUBJECT_ID_ENV_VAR = "ORY_AGENT_SUBJECT_ID";
+/**
+ * Validate a subject override (issue #241).
+ *
+ * `deriveSubject` above already refuses to produce a trailing separator,
+ * because a subject ending in `|` silently never matches a stored relation.
+ * The same care is owed to the *base* it joins onto, which arrives from an
+ * operator-settable env var and was previously used verbatim.
+ *
+ * A value containing the axis separator is rejected for two independent
+ * reasons:
+ *
+ * 1. **It collapses the identity grains.** The credential, session, and spawn
+ *    subjects are told apart only by separator position, so an override
+ *    containing one makes them ambiguous: `override="a|b"` in session `c` and
+ *    `override="a"` in session `b|c` produce the same string. A session-scoped
+ *    block written to stop one runaway run could then match the base credential, or a
+ *    different run — and all three grains are read together in one batched
+ *    check, so this is a live semantics break rather than a theoretical one.
+ * 2. **It forges a delegation-node reference** (#225). A join key is exactly
+ *    `<identity>|<harness>|<host>|<session>`, and the two string spaces stay
+ *    disjoint today only because a Hydra client id is a UUID and contains no
+ *    separator. This env var is the one supported knob that breaks that.
+ *
+ * Rejected rather than sanitized: silently stripping the separator would
+ * produce a *different* subject than the operator asked for, which fails just
+ * as confusingly and is harder to notice. Ignoring the value falls back to the
+ * client id — a real, working identity — and says so.
+ */
+function validateSubjectOverride(raw, envVar = exports.AGENT_SUBJECT_ID_ENV_VAR) {
+    if (raw === undefined)
+        return {};
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        return {
+            warning: `${envVar} is set but empty — ignoring it and using the client id as the subject.`,
+        };
+    }
+    if (trimmed.includes(exports.SUBJECT_AXIS_SEPARATOR)) {
+        return {
+            warning: `${envVar}="${trimmed}" contains "${exports.SUBJECT_AXIS_SEPARATOR}", which separates the derived `
+                + `session and spawn axes of a subject — a value containing it is ambiguous with a `
+                + `session-scoped subject and with a delegation-node reference. Ignoring it and using the `
+                + `client id as the subject.`,
+        };
+    }
+    return { value: trimmed };
+}
+/**
+ * Read and validate `ORY_AGENT_SUBJECT_ID`. Returns `undefined` when unset or
+ * rejected, pushing an explanation onto `warnings` in the latter case.
+ *
+ * One reader for every site that consumes the override, so the rule cannot hold
+ * in the resolver and not in what `status` reports.
+ */
+function readAgentSubjectOverride(env = process.env, warnings) {
+    const { value, warning } = validateSubjectOverride(env[exports.AGENT_SUBJECT_ID_ENV_VAR]);
+    if (warning)
+        warnings?.push(warning);
+    return value;
+}
+/**
+ * The registered agent credential subject: `Agent:<clientId>`. For DCR this
+ * client belongs to one session; static credentials may be shared explicitly.
+ *
+ * `undefined` when no agent principal is populated — the agent gate never
+ * blocks, so a session with no resolved machine identity is normal and callers
+ * must treat a missing agent subject as "nothing to check", not as a deny.
+ */
+function resolveAgentSubject(client) {
+    const subject = client.agentPrincipal.subject;
+    return subject ? subjectSet(exports.AGENT_NAMESPACE, subject) : undefined;
+}
+/**
+ * The **session-level** agent subject: `Agent:<clientId>|<session>`, unique to
+ * one run. Used for a block that stops the session's narrower subject without
+ * blocking its base credential subject.
+ *
+ * `undefined` when there is no agent principal, and — deliberately — also when
+ * there is no session. A caller with no session concept (an SDK integration in
+ * a long-running service) has exactly one sessionless credential subject;
+ * inventing a placeholder session would either collapse every run onto
+ * one string or produce a subject no admin could have written.
+ */
+function resolveAgentSessionSubject(client, sessionId) {
+    const subject = client.agentPrincipal.subject;
+    const session = (sessionId ?? client.sessionId)?.trim();
+    if (!subject || !session)
+        return undefined;
+    return subjectSet(exports.AGENT_NAMESPACE, deriveSubject(subject, session));
+}
+/**
+ * The registered sub-agent credential subject: `SubAgent:<clientId>` for one
+ * typed sub-agent in one session.
+ *
+ * `subAgentClientId` is the client id from {@link ensureSubAgentIdentity};
+ * `undefined` in, and `undefined` out, since a sub-agent whose identity did not
+ * resolve has nothing to check.
+ */
+function resolveSubAgentSubject(subAgentClientId) {
+    return subAgentClientId
+        ? subjectSet(exports.SUBAGENT_NAMESPACE, subAgentClientId)
+        : undefined;
+}
+/**
+ * The **spawn-level** sub-agent subject:
+ * `SubAgent:<clientId>|<session>|<type>[|<spawn>]`, the finest grain available.
+ *
+ * `perSpawnId` distinguishes two *concurrent* same-type sub-agents and is only
+ * present on harnesses that expose one (Cursor's `subagent_id`, Claude Code's
+ * `agent_id`, OpenClaw's `childRunId`, …). Where the harness exposes none the
+ * subject stops at the type and concurrent spawns share it — a limit of the
+ * harness, not of this model.
+ *
+ * As with the agent session subject, a missing session yields `undefined`
+ * rather than a placeholder.
+ */
+function resolveSubAgentSpawnSubject(client, args) {
+    const session = (args.sessionId ?? client.sessionId)?.trim();
+    if (!args.subAgentClientId || !session)
+        return undefined;
+    return subjectSet(exports.SUBAGENT_NAMESPACE, deriveSubject(args.subAgentClientId, session, args.subAgentType, args.perSpawnId));
+}

package/dist/testing.d.ts

@@ -7,7 +7,8 @@
  */
 import { vi } from "vitest";
 import { OryAgentClient } from "./client.js";
-import type { TraceSpan, TraceEvent } from "./tracer.js";
+import type { ActivityEntry } from "./logger.js";
+import type { PermissionMode } from "./config.js";
 export { runHarnessContractSuite, type HarnessContractAdapter, type ContractContext, type ContractGates, type ContractOutcome, } from "./contract-suite.js";
 /**
  * Create an OryAgentClient with session caching disabled.
@@ -15,18 +16,26 @@ export { runHarnessContractSuite, type HarnessContractAdapter, type ContractCont
  */
 export declare function createMockClient(overrides?: Partial<ConstructorParameters<typeof OryAgentClient>[0]>): OryAgentClient;
 /**
- * Control what the exact-tuple existence probe ({@link OryAgentClient.relationshipExists},
- * used by `ensureRelationship`) reports. Pass `true` to model a tuple that is
- * already stored (the write is then skipped), `false` for absent (the write
- * proceeds). Returns the spy so callers can e.g. `.mockRejectedValue(...)` to
- * model a failed probe.
+ * Spy on {@link OryAgentClient.recordDelegation} (the agent-security broker
+ * call the delegation writers use). Resolves to `result` (a stub node by
+ * default). Returns the spy so callers assert the broker inputs or
+ * `.mockRejectedValue(...)` a broker failure.
  */
-export declare function stubRelationshipExists(client: OryAgentClient, exists: boolean): import("vitest").Mock<(check: import("./types.js").PermissionCheck) => Promise<boolean>>;
+export declare function spyRecordDelegation(client: OryAgentClient, result?: {
+    nodeId: string;
+    delegationChain: string[];
+}): import("vitest").Mock<(input: import("./client.js").RecordDelegationInput, options?: {
+    fetchImpl?: typeof fetch;
+    activityAttributes?: Record<string, unknown>;
+    agentToken?: string;
+    runtimeCredential?: import("./runtime-credential.js").RuntimeCredential;
+    signal?: AbortSignal;
+}) => Promise<import("./client.js").RecordDelegationResult>>;
 /**
  * Stub an internal API instance method on the client.
  * Returns a vi.fn mock so callers can assert on calls.
  */
-export declare function stubApi<K extends "frontend" | "oauth2" | "permission" | "relationship">(client: OryAgentClient, api: K, method: string, impl: (...args: unknown[]) => unknown): ReturnType<typeof vi.fn>;
+export declare function stubApi<K extends "frontend" | "oauth2" | "permission">(client: OryAgentClient, api: K, method: string, impl: (...args: unknown[]) => unknown): ReturnType<typeof vi.fn>;
 /** Successful session verification response (wraps Ory API shape). */
 export declare const MOCK_SESSION_RESPONSE: {
     data: {
@@ -132,28 +141,40 @@ export declare function makeMfaRequiredError(): Record<string, unknown>;
 /** Axios 401 with session_inactive error id. */
 export declare function makeSessionInactiveError(): Record<string, unknown>;
 /**
- * Get all recorded trace spans from a client, optionally filtered by event.
+ * Get all recorded activity events from a client, optionally filtered by event.
  */
-export declare function getTraceSpans(client: OryAgentClient, event?: TraceEvent): TraceSpan[];
+export declare function getActivityEvents(client: OryAgentClient, event?: string): ActivityEntry[];
 /**
- * Assert the tracer recorded the expected tool names for a given event type.
- * Checks the `toolName` attribute on each span.
+ * Assert the activity log recorded the expected tool names for an event type.
  */
-export declare function expectTracedTools(client: OryAgentClient, event: TraceEvent, expectedTools: string[]): void;
+export declare function expectActivityTools(client: OryAgentClient, event: string, expectedTools: string[]): void;
 /**
  * Set standard Ory env vars for a configured + authenticated test.
  * Returns a cleanup function that restores the previous state.
  */
 export declare function setOryEnv(overrides?: Partial<{
     projectUrl: string;
-    sessionToken: string;
-    oauth2Token: string;
+    agentSecurityUrl: string;
+    /**
+     * Public OAuth2 client id. Together with `projectUrl` this is what makes
+     * Agent Security connected — pass `undefined` for either to exercise the
+     * not-connected path.
+     */
+    oauth2ClientId: string;
+    /**
+     * Pre-supplied user OAuth2 access token (`ORY_USER_OAUTH2_TOKEN`) — the one
+     * accepted env credential. Pass `undefined` so the login gate does not
+     * short-circuit on it.
+     */
+    userToken: string;
     subjectId: string;
     namespace: string;
     /**
      * Permission mode for the test. Defaults to `"enforce"` so existing
-     * test assertions that exercise the deny path still see a block.
-     * Pass `"observe"` explicitly to exercise the new observe branch.
+     * test assertions that exercise the deny path still see a block. The mode
+     * is now a server-read Keto permission, so this sets the value the
+     * {@link stubPermissionAllowed}/`Denied` stubs report for the mode check —
+     * it is NOT an env var (there is no `ORY_PERMISSION_MODE` anymore).
      */
     permissionMode: "observe" | "enforce";
 }>): () => void;
@@ -164,9 +185,37 @@ export declare function setOryEnv(overrides?: Partial<{
  * that restores the env var and removes the temp directory.
  *
  * Use `saveConfig(...)` from `./config.js` inside the test to shape the
- * isolated config (e.g. `saveConfig({ auditOnly: true })`).
+ * isolated config (e.g. `saveConfig({ projectUrl, oauth2ClientId })`).
  */
 export declare function useTempConfigDir(): () => void;
+/** Placeholder values `connectSecurity` / `disconnectSecurity` write. */
+export declare const TEST_PROJECT_URL = "https://test.projects.oryapis.com";
+export declare const TEST_AGENT_SECURITY_URL = "https://agents.console.ory.com";
+export declare const TEST_OAUTH2_CLIENT_ID = "test-login-client";
+/**
+ * Put the isolated config into the **connected** state so the auth gates and
+ * permission checks actually run.
+ *
+ * Agent Security is connected exactly when a project URL and an OAuth2 client
+ * id both resolve — there is no flag to set. Tests that exercise checks need
+ * both, and writing them through one named call keeps that requirement in one
+ * place instead of two literals in every `beforeEach`.
+ *
+ * Call after `useTempConfigDir()` so it writes to the temp config.
+ */
+export declare function connectSecurity(overrides?: {
+    projectUrl?: string;
+    agentSecurityUrl?: string;
+    oauth2ClientId?: string;
+}): void;
+/**
+ * Put the isolated config into a partial connection state for contract tests.
+ *
+ * `which` selects which connection values are absent. The `no-client-id` case
+ * now exercises the reserved client default rather than a disconnected state.
+ * The `neither` and `no-project-url` forms remain disconnected.
+ */
+export declare function disconnectSecurity(which?: "neither" | "no-client-id" | "no-project-url"): void;
 /**
  * Clear all Ory env vars (simulate unconfigured state).
  */
@@ -185,33 +234,20 @@ export declare function stubSessionExpired(client: OryAgentClient): import("vite
 export declare function stubOAuth2Success(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub introspectToken to return inactive. */
 export declare function stubOAuth2Inactive(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+/**
+ * Set the mode the server-read stub reports. Also clears the in-memory
+ * permission-mode cache so the new value takes effect immediately (tests run
+ * with `ORY_PERMISSION_MODE_TTL_MS=0`, but resetting is belt-and-suspenders).
+ */
+export declare function setTestPermissionMode(mode: PermissionMode): void;
 /** Stub checkPermission to allow. */
 export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
-/** Stub checkPermission to deny. */
+/** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
 export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub checkPermission to throw a network error. */
 export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub checkPermission to throw a rate-limit error. */
 export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
-/**
- * Spy on the public `createRelationship` method and resolve successfully.
- * Prefer this over stubbing the internal relationship API: `setAgentPrincipal`
- * rebuilds the API instances when the agent token changes (e.g. inside
- * `sessionStart`), which silently discards API-level stubs.
- */
-export declare function spyRelationshipCreated(client: OryAgentClient): import("vitest").Mock<(check: import("./types.js").PermissionCheck, options?: {
-    spanAttributes?: Record<string, unknown>;
-}) => Promise<{
-    created: boolean;
-    alreadyExisted: boolean;
-}>>;
-/** Spy on the public `createRelationship` method and reject. */
-export declare function spyRelationshipCreateError(client: OryAgentClient): import("vitest").Mock<(check: import("./types.js").PermissionCheck, options?: {
-    spanAttributes?: Record<string, unknown>;
-}) => Promise<{
-    created: boolean;
-    alreadyExisted: boolean;
-}>>;
 /** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */
 export declare function stubMcpAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub checkPermission to deny (server-only MCP check). */