@ory/argus 0.14.0 → 1.0.1

package/dist/watch-sandbox.js

@@ -1,81 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/**
- * Live trace watcher for the dev sandbox.
- *
- * Tails the NDJSON trace file produced by `pnpm dev:<harness>` and prints
- * a colorized line per span as they arrive. Run in a second terminal
- * alongside the dev launcher.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const tracer_js_1 = require("./tracer.js");
-function workspaceRoot() {
-    // This file ships at packages/core/dist/watch-sandbox.js.
-    // Walk up to the workspace root.
-    return path.resolve(__dirname, "..", "..", "..");
-}
-function resolveTraceFile(arg) {
-    if (arg && (arg.includes("/") || arg.includes("\\") || arg.endsWith(".ndjson"))) {
-        return path.resolve(arg);
-    }
-    const harness = arg ?? process.env.ORY_DEV_HARNESS;
-    if (!harness) {
-        console.error("Usage: ory-watch-sandbox <harness>\n" +
-            "  e.g. ory-watch-sandbox claude-code\n" +
-            "  Or pass an explicit trace file path.");
-        process.exit(1);
-    }
-    return path.resolve(workspaceRoot(), ".sandbox", harness, "ory-agent-trace.ndjson");
-}
-function main() {
-    const traceFile = resolveTraceFile(process.argv[2]);
-    console.log(`Watching traces: ${traceFile}`);
-    if (!fs.existsSync(traceFile)) {
-        console.log("(file does not exist yet — waiting for the dev launcher to start producing spans)");
-    }
-    console.log("Press Ctrl+C to stop.\n");
-    const stop = (0, tracer_js_1.watchTraceFile)(traceFile, (span) => {
-        console.log((0, tracer_js_1.formatSpan)(span));
-    });
-    process.on("SIGINT", () => {
-        stop();
-        console.log("\nStopped watching.");
-        process.exit(0);
-    });
-}
-main();

package/dist/web/api.d.ts

@@ -1,33 +0,0 @@
-/**
- * JSON API for the local web installer / status dashboard. Each route is a
- * thin wrapper over a headless action in {@link file://../setup-actions.ts} or
- * the status data in {@link file://../status-data.ts}. All state for one
- * install run (the resolved `ory` runner, the selected workspace/project, and
- * the in-flight browser sub-flows) lives in a single {@link SetupSession} held
- * by the server for its lifetime.
- *
- * Handlers never throw for expected failures — they return an `{ error }`
- * envelope with an appropriate HTTP status so the SPA can surface it and the
- * user can retry, exactly like the TTY wizard's fail-open steps.
- */
-import { type SetupActionDeps } from "../setup-actions.js";
-import type { WebAppMode } from "./types.js";
-export interface ApiResult {
-    status: number;
-    json: unknown;
-}
-export interface ApiContext {
-    mode: WebAppMode;
-    harness: string;
-    binName: string;
-    deps: SetupActionDeps;
-    /** Called when the SPA POSTs /api/shutdown. */
-    onShutdown: () => void;
-}
-/**
- * Build the API request handler bound to one server run. Returns
- * `handle(method, path, body)` producing an {@link ApiResult}.
- */
-export declare function createApi(ctx: ApiContext): {
-    handle: (method: string, path: string, body: Record<string, unknown>) => Promise<ApiResult>;
-};

package/dist/web/api.js

@@ -1,294 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createApi = createApi;
-/**
- * JSON API for the local web installer / status dashboard. Each route is a
- * thin wrapper over a headless action in {@link file://../setup-actions.ts} or
- * the status data in {@link file://../status-data.ts}. All state for one
- * install run (the resolved `ory` runner, the selected workspace/project, and
- * the in-flight browser sub-flows) lives in a single {@link SetupSession} held
- * by the server for its lifetime.
- *
- * Handlers never throw for expected failures — they return an `{ error }`
- * envelope with an appropriate HTTP status so the SPA can surface it and the
- * user can retry, exactly like the TTY wizard's fail-open steps.
- */
-const setup_actions_js_1 = require("../setup-actions.js");
-const status_data_js_1 = require("../status-data.js");
-const config_js_1 = require("../config.js");
-const version_cli_js_1 = require("../version-cli.js");
-const ok = (json = { ok: true }) => ({ status: 200, json });
-const bad = (error, status = 400) => ({ status, json: { error } });
-/**
- * Build the API request handler bound to one server run. Returns
- * `handle(method, path, body)` producing an {@link ApiResult}.
- */
-function createApi(ctx) {
-    const session = {
-        runner: ctx.deps.runner ?? null,
-        subject: null,
-    };
-    /** The runner to use, failing loudly if `POST /api/ory-cli` hasn't run. */
-    function runner() {
-        return session.runner;
-    }
-    async function handle(method, path, body) {
-        const route = `${method} ${path}`;
-        switch (route) {
-            case "GET /api/bootstrap": {
-                const cfg = (0, config_js_1.resolveConfig)();
-                const payload = {
-                    mode: ctx.mode,
-                    harness: ctx.harness,
-                    binName: ctx.binName,
-                    version: (0, version_cli_js_1.resolveCoreVersion)(),
-                    alreadyConfigured: !!cfg.projectUrl || cfg.auditOnly,
-                    auditOnly: cfg.auditOnly,
-                    projectUrl: cfg.projectUrl,
-                };
-                return ok(payload);
-            }
-            case "GET /api/status":
-                return ok(await (0, status_data_js_1.collectStatusReport)(ctx.harness));
-            case "POST /api/ory-cli": {
-                const res = await (0, setup_actions_js_1.ensureOryCli)(ctx.deps);
-                session.runner = res.runner;
-                return ok({ present: res.present, installed: res.installed });
-            }
-            case "GET /api/signin": {
-                const r = runner();
-                return ok({ signedIn: r ? (0, setup_actions_js_1.isSignedIn)(r) : false });
-            }
-            case "POST /api/signin": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                if ((0, setup_actions_js_1.isSignedIn)(r))
-                    return ok({ started: false, signedIn: true });
-                const handle = (0, setup_actions_js_1.startSignIn)(r);
-                const task = { handle, state: "running" };
-                session.signIn = task;
-                handle.done.then((success) => {
-                    task.state = success ? "done" : "failed";
-                });
-                return ok({ started: true, signedIn: false });
-            }
-            case "GET /api/signin/status": {
-                const r = runner();
-                const task = session.signIn;
-                const state = task?.state ?? "idle";
-                // Treat a live session as done even if we never launched `ory auth`
-                // (the CLI may already have been signed in).
-                const signedIn = state === "done" || (!!r && (0, setup_actions_js_1.isSignedIn)(r));
-                return ok({ state: signedIn ? "done" : state, signedIn });
-            }
-            case "GET /api/workspaces": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                const workspaces = (0, setup_actions_js_1.listWorkspaces)(r);
-                if (workspaces === null)
-                    return bad("Could not list workspaces", 502);
-                session.workspaces = workspaces;
-                return ok({ workspaces });
-            }
-            case "POST /api/workspaces": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                const name = str(body.name);
-                if (!name)
-                    return bad("A workspace name is required");
-                const res = (0, setup_actions_js_1.createWorkspace)(r, name);
-                if (!res.ok)
-                    return bad(res.error ?? "Could not create workspace", 502);
-                return ok({ workspace: res.value });
-            }
-            case "GET /api/projects": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                const workspaceId = str(body.workspaceId);
-                if (!workspaceId)
-                    return bad("A workspaceId is required");
-                session.workspaceId = workspaceId;
-                session.workspaceName = session.workspaces?.find((w) => w.id === workspaceId)?.name;
-                const projects = (0, setup_actions_js_1.listProjects)(r, workspaceId);
-                if (projects === null)
-                    return bad("Could not list projects", 502);
-                return ok({ projects, cap: setup_actions_js_1.PROJECT_CAP, canCreate: projects.length < setup_actions_js_1.PROJECT_CAP });
-            }
-            case "POST /api/projects": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                const workspaceId = str(body.workspaceId) ?? session.workspaceId;
-                const name = str(body.name);
-                if (!workspaceId || !name)
-                    return bad("workspaceId and name are required");
-                const res = (0, setup_actions_js_1.createProject)(r, workspaceId, name);
-                if (!res.ok)
-                    return bad(res.error ?? "Could not create project", 502);
-                return ok({ project: res.value });
-            }
-            case "POST /api/select-project": {
-                const r = runner();
-                if (!r)
-                    return bad("Ory CLI is not ready", 409);
-                const project = body.project;
-                if (!project?.id)
-                    return bad("A project is required");
-                const url = (0, setup_actions_js_1.resolveProjectUrl)(project);
-                if (!url.ok)
-                    return bad(url.error ?? "Could not resolve project URL", 422);
-                session.project = project;
-                session.projectUrl = url.value;
-                // Ensure the OAuth2 login/consent UI is the Ory Managed Account
-                // Experience so the PKCE user login (step 7) renders a working page —
-                // a CLI-created project defaults these to the localhost:3000 sample.
-                const loginUi = (0, setup_actions_js_1.ensureManagedLoginUi)(r, project.id);
-                return ok({ projectUrl: url.value, dcrEnabled: (0, setup_actions_js_1.getDcrState)(r, project.id), loginUi });
-            }
-            case "POST /api/enable-dcr": {
-                const r = runner();
-                if (!r || !session.project)
-                    return bad("No project selected", 409);
-                return ok({ ok: (0, setup_actions_js_1.enableDcrAction)(r, session.project.id) });
-            }
-            case "POST /api/oauth2-client": {
-                const r = runner();
-                if (!r || !session.project)
-                    return bad("No project selected", 409);
-                const res = (0, setup_actions_js_1.provisionOAuth2Client)(r, session.project.id);
-                if (!res.ok || !res.clientId)
-                    return bad("Could not provision the OAuth2 client", 502);
-                session.oauth2ClientId = res.clientId;
-                return ok({ clientId: res.clientId, reused: res.reused, name: res.name });
-            }
-            case "POST /api/save": {
-                if (!session.project || !session.projectUrl || !session.oauth2ClientId) {
-                    return bad("Setup is incomplete (missing project / client)", 409);
-                }
-                (0, setup_actions_js_1.saveNetworkConfig)({
-                    projectUrl: session.projectUrl,
-                    projectId: session.project.id,
-                    oauth2ClientId: session.oauth2ClientId,
-                    projectName: session.project.name ?? session.project.slug,
-                    workspaceName: session.workspaceName,
-                });
-                return ok();
-            }
-            case "POST /api/login": {
-                if (session.login?.state === "running")
-                    return ok({ started: false });
-                // Pin the project the wizard resolved so a stale ORY_PROJECT_URL in the
-                // user's shell can't send the login to the wrong URL (e.g. :3000).
-                const task = {
-                    promise: (0, setup_actions_js_1.runFullSetup)(ctx.binName, ctx.harness, ctx.deps, {
-                        projectUrl: session.projectUrl,
-                        oauth2ClientId: session.oauth2ClientId,
-                    }),
-                    state: "running",
-                };
-                session.login = task;
-                task.promise.then((result) => {
-                    task.state = result.authenticated ? "done" : "failed";
-                    task.result = result;
-                    if (result.subject) {
-                        session.subject = result.subject;
-                        // The login only resolves an opaque subject id; look the identity up
-                        // via the admin CLI to show a readable name (email) instead of a UUID.
-                        const sid = "subjectId" in result.subject
-                            ? result.subject.subjectId
-                            : result.subject.subjectSet.object;
-                        const r = session.runner;
-                        if (r && session.project && sid) {
-                            const name = (0, setup_actions_js_1.resolveIdentityName)(r, session.project.id, sid);
-                            if (name)
-                                task.result = { ...result, subjectLabel: name };
-                        }
-                    }
-                });
-                return ok({ started: true });
-            }
-            case "GET /api/login/status": {
-                const task = session.login;
-                return ok({
-                    state: task?.state ?? "idle",
-                    authenticated: task?.result?.authenticated ?? false,
-                    subjectLabel: task?.result?.subjectLabel ?? null,
-                });
-            }
-            case "GET /api/permissions/model": {
-                const r = runner();
-                if (!r || !session.project)
-                    return bad("No project selected", 409);
-                return ok(await (0, setup_actions_js_1.inspectPermissions)(r, session.project.id));
-            }
-            case "POST /api/permissions/provision": {
-                const r = runner();
-                if (!r || !session.project)
-                    return bad("No project selected", 409);
-                const opl = str(body.opl);
-                return ok({ ok: (0, setup_actions_js_1.provisionPermissions)(r, session.project.id, undefined, opl) });
-            }
-            case "POST /api/permissions/grant": {
-                const r = runner();
-                if (!r || !session.project)
-                    return bad("No project selected", 409);
-                if (!session.subject)
-                    return bad("Sign in first so permissions can be granted to you", 409);
-                const res = (0, setup_actions_js_1.grantToolPermissions)(r, session.project.id, ctx.harness, session.subject);
-                return ok(res);
-            }
-            case "POST /api/api-key": {
-                if (!session.project || !session.projectUrl)
-                    return bad("No project selected", 409);
-                const res = await (0, setup_actions_js_1.provisionProjectApiKey)({
-                    projectId: session.project.id,
-                    projectUrl: session.projectUrl,
-                    harness: ctx.harness,
-                    user: session.subject
-                        ? (0, setup_actions_js_1.resourceUserLabel)(runner(), session.project.id, session.subject)
-                        : undefined,
-                }, ctx.deps);
-                return ok(res);
-            }
-            case "POST /api/audit-only": {
-                (0, setup_actions_js_1.configureAuditOnly)();
-                return ok();
-            }
-            // Live toggle from the dashboard (permission posture).
-            case "POST /api/config": {
-                const patch = {};
-                if ("permissionMode" in body) {
-                    if (body.permissionMode !== "observe" && body.permissionMode !== "enforce") {
-                        return bad("permissionMode must be 'observe' or 'enforce'");
-                    }
-                    (0, setup_actions_js_1.setPermissionMode)(body.permissionMode);
-                    patch.permissionMode = body.permissionMode;
-                }
-                if (Object.keys(patch).length === 0)
-                    return bad("No supported config fields in request");
-                return ok(patch);
-            }
-            case "POST /api/local": {
-                const res = await (0, setup_actions_js_1.configureLocalStack)(ctx.deps);
-                // Record the local connection so the subsequent login pins to it too.
-                session.projectUrl = res.projectUrl;
-                session.oauth2ClientId = res.oauth2ClientId;
-                return ok(res);
-            }
-            case "POST /api/shutdown": {
-                ctx.onShutdown();
-                return ok();
-            }
-            default:
-                return bad(`Unknown route: ${route}`, 404);
-        }
-    }
-    return { handle };
-}
-function str(v) {
-    return typeof v === "string" && v.trim() ? v.trim() : undefined;
-}

package/dist/web/launch.d.ts

@@ -1,11 +0,0 @@
-import type { SetupActionDeps } from "../setup-actions.js";
-/**
- * Heuristic for whether we can meaningfully open a browser for the user:
- * an interactive TTY, not CI, not opted-out, and — on Linux — an actual
- * display server. macOS/Windows are assumed to have a default browser.
- */
-export declare function canLaunchBrowser(): boolean;
-/** Open the guided install/setup wizard in the browser. */
-export declare function launchWebInstaller(binName: string, harness: string, deps?: SetupActionDeps): Promise<boolean>;
-/** Open the status dashboard in the browser. */
-export declare function launchWebDashboard(binName: string, harness: string, deps?: SetupActionDeps): Promise<boolean>;

package/dist/web/launch.js

@@ -1,96 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canLaunchBrowser = canLaunchBrowser;
-exports.launchWebInstaller = launchWebInstaller;
-exports.launchWebDashboard = launchWebDashboard;
-/**
- * Deciding whether to open the browser, and doing it. `canLaunchBrowser()`
- * gates the web UI on an interactive, non-CI environment with a usable display;
- * `launchWebInstaller` / `launchWebDashboard` start the local server, open the
- * browser, and block until the SPA signals it is done (or the user hits
- * Ctrl+C). Every entry point is fail-open: a launch that can't start returns
- * `false` so the caller falls back to the TTY wizard / text readout.
- */
-const server_js_1 = require("./server.js");
-/** Whether the environment opts out of the web UI. */
-function webDisabledByEnv() {
-    const off = (v) => v === "1" || v === "true" || v === "yes";
-    return off(process.env.ORY_NO_WEB?.trim()) || off(process.env.ORY_SETUP_NO_WEB?.trim());
-}
-/**
- * Heuristic for whether we can meaningfully open a browser for the user:
- * an interactive TTY, not CI, not opted-out, and — on Linux — an actual
- * display server. macOS/Windows are assumed to have a default browser.
- */
-function canLaunchBrowser() {
-    if (webDisabledByEnv())
-        return false;
-    if (process.env.CI)
-        return false;
-    if (!process.stdout.isTTY)
-        return false;
-    if (process.platform === "linux") {
-        return !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
-    }
-    return process.platform === "darwin" || process.platform === "win32";
-}
-async function openBrowser(url) {
-    try {
-        const mod = (await import("open"));
-        await mod.default(url);
-    }
-    catch {
-        /* the URL is also printed to stderr; the user can open it manually */
-    }
-}
-/**
- * Start the server, open the browser, and wait until the SPA POSTs
- * `/api/shutdown` or the user interrupts. Returns true once handled; false if
- * the server could not start (caller falls back).
- */
-async function launch(opts) {
-    let server;
-    try {
-        server = await (0, server_js_1.startServer)({
-            mode: opts.mode,
-            harness: opts.harness,
-            binName: opts.binName,
-            deps: opts.deps,
-        });
-    }
-    catch {
-        return false;
-    }
-    // All human-facing output goes to stderr — stdout stays clean for any harness
-    // that parses it.
-    console.error("");
-    console.error(`  Ory Agent ${opts.label} is running in your browser:`);
-    console.error(`    ${server.url}`);
-    console.error(`  Leave this terminal open; press Ctrl+C when you're done.`);
-    console.error("");
-    await openBrowser(server.url);
-    const onSigint = () => server.close();
-    process.once("SIGINT", onSigint);
-    try {
-        await server.closed;
-        // The shutdown request resolves `closed` before its HTTP response has
-        // flushed; give the browser a beat to receive it before we tear down the
-        // sockets (otherwise the SPA's final fetch just errors — harmless, but
-        // this keeps the "done" confirmation clean).
-        await new Promise((r) => setTimeout(r, 150));
-    }
-    finally {
-        process.removeListener("SIGINT", onSigint);
-        await server.close();
-    }
-    console.error("  Done — you can close the browser tab.");
-    return true;
-}
-/** Open the guided install/setup wizard in the browser. */
-function launchWebInstaller(binName, harness, deps) {
-    return launch({ mode: "install", binName, harness, deps, label: "setup" });
-}
-/** Open the status dashboard in the browser. */
-function launchWebDashboard(binName, harness, deps) {
-    return launch({ mode: "status", binName, harness, deps, label: "status" });
-}

package/dist/web/server.d.ts

@@ -1,20 +0,0 @@
-import type { SetupActionDeps } from "../setup-actions.js";
-import type { WebAppMode } from "./types.js";
-export interface StartServerOptions {
-    mode: WebAppMode;
-    harness: string;
-    binName: string;
-    deps?: SetupActionDeps;
-    /** Override the static web root (defaults to the built `dist/webapp`). */
-    webRoot?: string;
-}
-export interface RunningServer {
-    url: string;
-    port: number;
-    token: string;
-    /** Resolves when the SPA requests shutdown or {@link close} is called. */
-    closed: Promise<void>;
-    close(): Promise<void>;
-}
-/** Start the server. Resolves once it is listening. */
-export declare function startServer(opts: StartServerOptions): Promise<RunningServer>;