@ory/argus 0.14.0 → 1.0.0

package/dist/otel/otlp.js

@@ -1,385 +0,0 @@
-"use strict";
-/**
- * OTLP exporter — SDK-backed.
- *
- * Bridges our internal `TraceSpan` records into the official OpenTelemetry
- * SDK exporters from `@opentelemetry/exporter-trace-otlp-http` and
- * `@opentelemetry/exporter-trace-otlp-proto`. Each completed `TraceSpan`
- * is converted to a `ReadableSpan` shape and handed to the SDK exporter,
- * which serializes (JSON or protobuf) and POSTs to an OTLP HTTP endpoint.
- *
- * Standard OTel env vars consumed by `otlpExporterFromEnv()`. Each one has
- * an `ORY_OTLP_*`-prefixed alias that is consulted as a fallback when the
- * standard name is unset. Some harnesses (notably Claude Code) sanitize the
- * env passed to hook subprocesses and drop every `OTEL_*` var, so the dev
- * launcher mirrors each setting under the Ory prefix to survive the strip.
- *
- *   Standard name                          Ory-prefixed fallback
- *   ─────────────────────────────────────  ─────────────────────────────────
- *   OTEL_EXPORTER_OTLP_ENDPOINT            ORY_OTLP_ENDPOINT
- *   OTEL_EXPORTER_OTLP_TRACES_ENDPOINT     ORY_OTLP_TRACES_ENDPOINT
- *   OTEL_EXPORTER_OTLP_HEADERS             ORY_OTLP_HEADERS
- *   OTEL_EXPORTER_OTLP_TRACES_HEADERS      ORY_OTLP_TRACES_HEADERS
- *   OTEL_EXPORTER_OTLP_PROTOCOL            ORY_OTLP_PROTOCOL
- *   OTEL_EXPORTER_OTLP_TRACES_PROTOCOL     ORY_OTLP_TRACES_PROTOCOL
- *   OTEL_SERVICE_NAME                      ORY_OTLP_SERVICE_NAME
- *   OTEL_RESOURCE_ATTRIBUTES               ORY_OTLP_RESOURCE_ATTRIBUTES
- *
- * Failures are swallowed (callers receive a resolved Promise) so trace
- * export can never break the agent session. Transport errors surface
- * through the `onError` callback.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OtlpExporter = void 0;
-exports.otlpExporterFromEnv = otlpExporterFromEnv;
-exports.readEnvWithAlias = readEnvWithAlias;
-exports.parseKeyValueList = parseKeyValueList;
-exports.toReadableSpan = toReadableSpan;
-const api_1 = require("@opentelemetry/api");
-const core_1 = require("@opentelemetry/core");
-const resources_1 = require("@opentelemetry/resources");
-const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
-const exporter_trace_otlp_proto_1 = require("@opentelemetry/exporter-trace-otlp-proto");
-const TRACES_PATH = "/v1/traces";
-const SCOPE = {
-    name: "ory-agent-plugins",
-};
-/**
- * OTLP exporter that delegates wire-format serialization and HTTP transport
- * to the official `@opentelemetry/exporter-trace-otlp-*` SDK exporters.
- */
-class OtlpExporter {
-    endpoint;
-    protocol;
-    headers;
-    resource;
-    delegate;
-    onError;
-    inFlight = new Set();
-    constructor(opts) {
-        this.endpoint = opts.endpoint;
-        this.protocol = opts.protocol ?? "http/protobuf";
-        this.headers = { ...(opts.headers ?? {}) };
-        this.resource = (0, resources_1.resourceFromAttributes)(stripUndefined(opts.resource ?? {}));
-        this.onError = opts.onError ?? (() => undefined);
-        this.delegate =
-            opts.sdkExporter ??
-                buildSdkExporter(this.endpoint, this.protocol, this.headers, opts.timeoutMs);
-    }
-    export(spans) {
-        if (spans.length === 0)
-            return Promise.resolve();
-        const readables = spans.map((s) => toReadableSpan(s, this.resource));
-        const promise = new Promise((resolve) => {
-            try {
-                this.delegate.export(readables, (result) => {
-                    if (result.code !== core_1.ExportResultCode.SUCCESS) {
-                        this.onError(result.error ?? new Error("OTLP export failed"));
-                    }
-                    resolve();
-                });
-            }
-            catch (err) {
-                // Defensive — SDK exporter contract says export() must not throw,
-                // but we honor our own contract regardless.
-                this.onError(err);
-                resolve();
-            }
-        });
-        this.inFlight.add(promise);
-        promise.finally(() => this.inFlight.delete(promise));
-        return promise;
-    }
-    async shutdown() {
-        // Drain in-flight exports first. Subprocess hooks (claude-code, codex,
-        // gemini-cli) call process.exit() the instant they hand back stdout —
-        // without this drain the underlying HTTP request is killed mid-flight
-        // and spans never reach the collector even though the NDJSON file
-        // already contains them.
-        if (this.inFlight.size > 0) {
-            await Promise.allSettled([...this.inFlight]);
-        }
-        try {
-            await this.delegate.shutdown();
-        }
-        catch (err) {
-            this.onError(err);
-        }
-    }
-}
-exports.OtlpExporter = OtlpExporter;
-function buildSdkExporter(endpoint, protocol, headers, timeoutMs) {
-    const config = {
-        url: endpoint,
-        headers,
-        timeoutMillis: timeoutMs ?? 5_000,
-    };
-    return protocol === "http/json"
-        ? new exporter_trace_otlp_http_1.OTLPTraceExporter(config)
-        : new exporter_trace_otlp_proto_1.OTLPTraceExporter(config);
-}
-// ─── Factory ───────────────────────────────────────────────────────
-/**
- * Build an OtlpExporter from process env. Returns undefined when no
- * endpoint is configured or the requested protocol is unsupported.
- */
-function otlpExporterFromEnv(opts) {
-    const env = opts.env ?? process.env;
-    const endpoint = resolveEndpoint(env);
-    if (!endpoint)
-        return undefined;
-    const protocol = resolveProtocol(env, opts.onError);
-    if (!protocol)
-        return undefined;
-    const headers = mergeHeaders(parseKeyValueList(readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_HEADERS")), parseKeyValueList(readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_HEADERS")));
-    const resource = {
-        "service.name": readEnvWithAlias(env, "OTEL_SERVICE_NAME") ??
-            `ory-agent-plugin-${opts.harness}`,
-        "service.namespace": "ory.agent_plugins",
-        "ory.harness": opts.harness,
-        "process.pid": process.pid,
-        "process.runtime.name": "nodejs",
-        "process.runtime.version": process.version,
-    };
-    if (opts.hostname)
-        resource["host.name"] = opts.hostname;
-    if (opts.user)
-        resource["host.user"] = opts.user;
-    if (opts.pluginVersion)
-        resource["service.version"] = opts.pluginVersion;
-    if (opts.cwd)
-        resource["process.cwd"] = opts.cwd;
-    if (opts.gitBranch)
-        resource["ory.git.branch"] = opts.gitBranch;
-    if (opts.gitCommit)
-        resource["ory.git.commit"] = opts.gitCommit;
-    for (const [k, v] of Object.entries(parseKeyValueList(readEnvWithAlias(env, "OTEL_RESOURCE_ATTRIBUTES")))) {
-        resource[k] = v;
-    }
-    return new OtlpExporter({
-        endpoint,
-        protocol,
-        headers,
-        resource,
-        onError: opts.onError,
-    });
-}
-function resolveEndpoint(env) {
-    // ORY_OTLP_*-prefixed aliases survive harnesses (e.g. Claude Code) that
-    // sanitize the env passed to hook subprocesses and drop OTEL_*-prefixed
-    // vars. The standard OTel name still wins when present.
-    const tracesUrl = readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT");
-    if (tracesUrl)
-        return tracesUrl;
-    const base = readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_ENDPOINT");
-    if (!base)
-        return undefined;
-    return base.replace(/\/+$/, "") + TRACES_PATH;
-}
-function resolveProtocol(env, onError) {
-    const raw = (readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL") ??
-        readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_PROTOCOL") ??
-        "http/protobuf")
-        .trim()
-        .toLowerCase();
-    if (raw === "http/protobuf" || raw === "http/json")
-        return raw;
-    onError?.(new Error(`OTEL_EXPORTER_OTLP_PROTOCOL=${raw} not supported (only http/protobuf and http/json). Skipping OTel export.`));
-    return undefined;
-}
-/**
- * Standard OTel env var name → Ory-prefixed fallback. Standard wins when set;
- * the alias is consulted only when the standard name is empty/missing. The
- * historical `ORY_OTLP_ENDPOINT` alias for `OTEL_EXPORTER_OTLP_ENDPOINT` is
- * preserved verbatim for compatibility with existing dev-launcher envs.
- */
-const ORY_ENV_ALIAS = {
-    OTEL_EXPORTER_OTLP_ENDPOINT: "ORY_OTLP_ENDPOINT",
-    OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "ORY_OTLP_TRACES_ENDPOINT",
-    OTEL_EXPORTER_OTLP_HEADERS: "ORY_OTLP_HEADERS",
-    OTEL_EXPORTER_OTLP_TRACES_HEADERS: "ORY_OTLP_TRACES_HEADERS",
-    OTEL_EXPORTER_OTLP_PROTOCOL: "ORY_OTLP_PROTOCOL",
-    OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: "ORY_OTLP_TRACES_PROTOCOL",
-    OTEL_SERVICE_NAME: "ORY_OTLP_SERVICE_NAME",
-    OTEL_RESOURCE_ATTRIBUTES: "ORY_OTLP_RESOURCE_ATTRIBUTES",
-};
-/**
- * Read an OTel env var, falling back to its `ORY_OTLP_*`-prefixed alias when
- * the standard name is unset. Trims whitespace and treats empty strings as
- * absent so a propagated-but-blank var doesn't shadow the alias.
- */
-function readEnvWithAlias(env, standardName) {
-    const primary = env[standardName]?.trim();
-    if (primary)
-        return primary;
-    const aliasName = ORY_ENV_ALIAS[standardName];
-    if (!aliasName)
-        return undefined;
-    const alias = env[aliasName]?.trim();
-    return alias || undefined;
-}
-// ─── Env parsing helpers ───────────────────────────────────────────
-/**
- * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
- */
-function parseKeyValueList(raw) {
-    const out = {};
-    if (!raw)
-        return out;
-    for (const pair of raw.split(",")) {
-        const trimmed = pair.trim();
-        if (!trimmed)
-            continue;
-        const eq = trimmed.indexOf("=");
-        if (eq <= 0)
-            continue;
-        const key = trimmed.slice(0, eq).trim();
-        const value = trimmed.slice(eq + 1).trim();
-        if (!key)
-            continue;
-        out[key] = safeDecodeURIComponent(value);
-    }
-    return out;
-}
-function safeDecodeURIComponent(value) {
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value;
-    }
-}
-function mergeHeaders(...sources) {
-    const out = {};
-    for (const src of sources) {
-        for (const [k, v] of Object.entries(src)) {
-            out[k.toLowerCase()] = v;
-        }
-    }
-    return out;
-}
-// ─── TraceSpan → ReadableSpan conversion ───────────────────────────
-/**
- * Convert our internal `TraceSpan` record to an OTel SDK `ReadableSpan`.
- * Exported for tests; the OTLP exporters consume this shape directly.
- */
-function toReadableSpan(span, resource) {
-    // OTLP wire format expects 32-hex traceId / 16-hex spanId. Our internal
-    // IDs are shorter (hashed session prefix + random suffix), so pad with
-    // leading zeros to canonical width.
-    const traceId = padHex(span.traceId, 32);
-    const spanId = padHex(span.spanId, 16);
-    const ctx = {
-        traceId,
-        spanId,
-        traceFlags: 1, // sampled
-        isRemote: false,
-    };
-    const parentSpanContext = span.parentSpanId
-        ? {
-            traceId,
-            spanId: padHex(span.parentSpanId, 16),
-            traceFlags: 1,
-            isRemote: false,
-        }
-        : undefined;
-    const startTime = isoToHrTime(span.startedAt);
-    const endTime = isoToHrTime(span.endedAt);
-    const attributes = {
-        "ory.event": span.event,
-        "ory.span.status": span.status,
-        "ory.duration_ms": span.durationMs,
-    };
-    if (span.sessionId)
-        attributes["ory.session_id"] = span.sessionId;
-    for (const [k, v] of Object.entries(flattenAttributes(span.attributes ?? {}))) {
-        attributes[k] = v;
-    }
-    return {
-        name: span.event,
-        kind: api_1.SpanKind.INTERNAL,
-        spanContext: () => ctx,
-        parentSpanContext,
-        startTime,
-        endTime,
-        status: toOtelStatus(span.status),
-        attributes,
-        links: [],
-        events: [],
-        duration: hrTimeSubtract(endTime, startTime),
-        ended: true,
-        resource,
-        instrumentationScope: SCOPE,
-        droppedAttributesCount: 0,
-        droppedEventsCount: 0,
-        droppedLinksCount: 0,
-    };
-}
-function toOtelStatus(status) {
-    switch (status) {
-        case "ok":
-            return { code: api_1.SpanStatusCode.OK };
-        case "error":
-            return { code: api_1.SpanStatusCode.ERROR, message: "error" };
-        case "denied":
-            return { code: api_1.SpanStatusCode.ERROR, message: "denied" };
-        case "skipped":
-        default:
-            return { code: api_1.SpanStatusCode.UNSET };
-    }
-}
-function isoToHrTime(iso) {
-    const ms = Date.parse(iso);
-    if (!Number.isFinite(ms))
-        return [0, 0];
-    const seconds = Math.trunc(ms / 1000);
-    const nanos = (ms - seconds * 1000) * 1_000_000;
-    return [seconds, nanos];
-}
-function hrTimeSubtract(a, b) {
-    let sec = a[0] - b[0];
-    let nanos = a[1] - b[1];
-    if (nanos < 0) {
-        sec -= 1;
-        nanos += 1_000_000_000;
-    }
-    if (sec < 0) {
-        return [0, 0];
-    }
-    return [sec, nanos];
-}
-function padHex(hex, length) {
-    const lower = hex.toLowerCase().replace(/[^0-9a-f]/g, "");
-    if (lower.length >= length)
-        return lower.slice(-length);
-    return lower.padStart(length, "0");
-}
-function flattenAttributes(attrs) {
-    const out = {};
-    for (const [key, value] of Object.entries(attrs)) {
-        if (value === null || value === undefined)
-            continue;
-        if (typeof value === "string" ||
-            typeof value === "number" ||
-            typeof value === "boolean") {
-            out[key] = value;
-            continue;
-        }
-        try {
-            out[key] = JSON.stringify(value);
-        }
-        catch {
-            /* skip un-serializable values */
-        }
-    }
-    return out;
-}
-function stripUndefined(source) {
-    const out = {};
-    for (const [k, v] of Object.entries(source)) {
-        if (v === undefined)
-            continue;
-        out[k] = v;
-    }
-    return out;
-}

package/dist/project-api-key.d.ts

@@ -1,69 +0,0 @@
-/**
- * Ory Network **project API key** (project token) lifecycle via the Ory
- * Console API.
- *
- * Runtime permission checks authenticate to Ory's Permission (Keto) API with a
- * project API key — the agent's OAuth2 token isn't accepted there — so the
- * installer mints one. The `ory` CLI (as of v1.3) exposes no project-API-key
- * command, so this is the one place the plugin reaches past the CLI to the
- * Console API directly, authenticating with the CLI's stored Ory Network
- * session (`~/.ory-cloud.json`).
- *
- * These helpers own the full lifecycle so both the installer (create) and the
- * uninstaller (delete) speak to the same endpoint with the same auth. Every
- * function is best-effort and never throws — provisioning and teardown must not
- * crash on a missing session or a network blip.
- */
-export interface CreateProjectApiKeyArgs {
-    projectId: string;
-    /** Human-readable label shown in the Console's API-keys list. */
-    name: string;
-}
-/**
- * A minted project API key. `value` is the `ory_pat_…` secret (returned only at
- * creation); `id` is the stable token id used to manage/delete the key later.
- */
-export interface ProjectApiKeyResult {
-    value: string;
-    /** Token id, when the Console returned one — needed for later deletion. */
-    id?: string;
-}
-/** Outcome of a best-effort server-side project-API-key deletion. */
-export type ProjectApiKeyDeleteResult = {
-    status: "deleted";
-}
-/** Nothing to do server-side (no session, or no id to address the token). */
- | {
-    status: "skipped";
-    message: string;
-} | {
-    status: "failed";
-    message?: string;
-    httpStatus?: number;
-};
-/**
- * Read the Ory Network session bearer the `ory` CLI stores at
- * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
- * no token, or the token has expired. Never throws.
- */
-export declare function readConsoleSessionToken(): string | null;
-/**
- * Mint an Ory Network **project API key** via the Console API
- * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
- * Returns the `{ value, id }` pair, or null on any failure (no session, non-2xx,
- * missing value). Never throws — provisioning is best-effort.
- */
-export declare function createProjectApiKeyViaConsole(args: CreateProjectApiKeyArgs): Promise<ProjectApiKeyResult | null>;
-/**
- * Delete an Ory Network project API key via the Console API
- * (`DELETE /projects/{projectId}/tokens/{tokenId}`), authenticated with the
- * `ory` CLI session. Best-effort and never throws.
- *
- * A 404 (already gone) counts as `deleted` — the desired end state is reached.
- * When no CLI session is available there is nothing we can do server-side, so
- * the result is `skipped` (not a failure).
- */
-export declare function deleteProjectApiKeyViaConsole(args: {
-    projectId: string;
-    tokenId: string;
-}): Promise<ProjectApiKeyDeleteResult>;

package/dist/project-api-key.js

@@ -1,147 +0,0 @@
-"use strict";
-/**
- * Ory Network **project API key** (project token) lifecycle via the Ory
- * Console API.
- *
- * Runtime permission checks authenticate to Ory's Permission (Keto) API with a
- * project API key — the agent's OAuth2 token isn't accepted there — so the
- * installer mints one. The `ory` CLI (as of v1.3) exposes no project-API-key
- * command, so this is the one place the plugin reaches past the CLI to the
- * Console API directly, authenticating with the CLI's stored Ory Network
- * session (`~/.ory-cloud.json`).
- *
- * These helpers own the full lifecycle so both the installer (create) and the
- * uninstaller (delete) speak to the same endpoint with the same auth. Every
- * function is best-effort and never throws — provisioning and teardown must not
- * crash on a missing session or a network blip.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readConsoleSessionToken = readConsoleSessionToken;
-exports.createProjectApiKeyViaConsole = createProjectApiKeyViaConsole;
-exports.deleteProjectApiKeyViaConsole = deleteProjectApiKeyViaConsole;
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-/** Base URL for the Ory Console API. Override with `ORY_CONSOLE_API_URL`. */
-const CONSOLE_API_URL = process.env.ORY_CONSOLE_API_URL?.trim() || "https://api.console.ory.sh";
-/** Path to the session the `ory` CLI persists after `ory auth`. */
-const ORY_CLI_SESSION_FILE = ".ory-cloud.json";
-/**
- * Read the Ory Network session bearer the `ory` CLI stores at
- * `~/.ory-cloud.json`. Returns null when the file is absent, unparseable, has
- * no token, or the token has expired. Never throws.
- */
-function readConsoleSessionToken() {
-    try {
-        const raw = fs.readFileSync(path.join(os.homedir(), ORY_CLI_SESSION_FILE), "utf-8");
-        const parsed = JSON.parse(raw);
-        const token = parsed.access_token?.access_token;
-        if (!token)
-            return null;
-        const expiry = parsed.access_token?.expiry;
-        if (expiry) {
-            const expMs = Date.parse(expiry);
-            if (Number.isFinite(expMs) && expMs <= Date.now())
-                return null;
-        }
-        return token;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Mint an Ory Network **project API key** via the Console API
- * (`POST /projects/{id}/tokens`), authenticated with the `ory` CLI session.
- * Returns the `{ value, id }` pair, or null on any failure (no session, non-2xx,
- * missing value). Never throws — provisioning is best-effort.
- */
-async function createProjectApiKeyViaConsole(args) {
-    const token = readConsoleSessionToken();
-    if (!token)
-        return null;
-    try {
-        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens`, {
-            method: "POST",
-            headers: {
-                Authorization: `Bearer ${token}`,
-                "Content-Type": "application/json",
-            },
-            body: JSON.stringify({ name: args.name }),
-        });
-        if (!res.ok)
-            return null;
-        const body = (await res.json());
-        const value = typeof body.value === "string" && body.value.length > 0 ? body.value : null;
-        if (!value)
-            return null;
-        const id = typeof body.id === "string" && body.id.length > 0 ? body.id : undefined;
-        return { value, id };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Delete an Ory Network project API key via the Console API
- * (`DELETE /projects/{projectId}/tokens/{tokenId}`), authenticated with the
- * `ory` CLI session. Best-effort and never throws.
- *
- * A 404 (already gone) counts as `deleted` — the desired end state is reached.
- * When no CLI session is available there is nothing we can do server-side, so
- * the result is `skipped` (not a failure).
- */
-async function deleteProjectApiKeyViaConsole(args) {
-    const token = readConsoleSessionToken();
-    if (!token) {
-        return {
-            status: "skipped",
-            message: "no Ory Console session (run `ory auth` to enable server-side removal)",
-        };
-    }
-    try {
-        const res = await fetch(`${CONSOLE_API_URL}/projects/${args.projectId}/tokens/${args.tokenId}`, {
-            method: "DELETE",
-            headers: { Authorization: `Bearer ${token}` },
-        });
-        if (res.ok || res.status === 404)
-            return { status: "deleted" };
-        return { status: "failed", httpStatus: res.status };
-    }
-    catch (err) {
-        return { status: "failed", message: err?.message };
-    }
-}