@ory/argus 0.7.3 → 0.8.0

package/dist/client.js

@@ -6,7 +6,7 @@ const client_1 = require("@ory/client");
 const logger_js_1 = require("./logger.js");
 const tracer_js_1 = require("./tracer.js");
 const config_js_1 = require("./config.js");
-const otlp_http_js_1 = require("./otel/otlp-http.js");
+const otlp_js_1 = require("./otel/otlp.js");
 class OryAgentClient {
     frontend;
     oauth2;
@@ -642,7 +642,7 @@ class OryAgentClient {
 exports.OryAgentClient = OryAgentClient;
 function attachOtlpExporterFromEnv(client, harness) {
     const meta = client.tracer.processMetadata;
-    const exporter = (0, otlp_http_js_1.otlpExporterFromEnv)({
+    const exporter = (0, otlp_js_1.otlpExporterFromEnv)({
         harness,
         hostname: meta.hostname,
         user: meta.user,

package/dist/index.d.ts

@@ -21,4 +21,4 @@ export { parseClaudeCodeMcpTool, parseGeminiMcpTool, parseMcpToolGeneric, checkM
 export { resolveUserSubject, subjectLabel, type UserSubjectRef, } from "./subject.js";
 export { formatDenialMessage, formatDenialSummary, formatAlertMessage, formatAlertSummary, alertAttributes, OryDenialError, type DenialContext, type AlertAttributes, } from "./denial.js";
 export { summarizeToolInput, summarizeToolOutput, type ToolInputSummary, type ToolOutputSummary, } from "./tool-metadata.js";
-export { OtlpHttpExporter, otlpExporterFromEnv, parseKeyValueList, type SpanExporter, type OtlpHttpExporterOptions, } from "./otel/index.js";
+export { OtlpExporter, otlpExporterFromEnv, parseKeyValueList, type SpanExporter, type OtlpExporterOptions, type OtlpProtocol, } from "./otel/index.js";

package/dist/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
 exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = void 0;
-exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpHttpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
+exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -150,6 +150,6 @@ var tool_metadata_js_1 = require("./tool-metadata.js");
 Object.defineProperty(exports, "summarizeToolInput", { enumerable: true, get: function () { return tool_metadata_js_1.summarizeToolInput; } });
 Object.defineProperty(exports, "summarizeToolOutput", { enumerable: true, get: function () { return tool_metadata_js_1.summarizeToolOutput; } });
 var index_js_3 = require("./otel/index.js");
-Object.defineProperty(exports, "OtlpHttpExporter", { enumerable: true, get: function () { return index_js_3.OtlpHttpExporter; } });
+Object.defineProperty(exports, "OtlpExporter", { enumerable: true, get: function () { return index_js_3.OtlpExporter; } });
 Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return index_js_3.otlpExporterFromEnv; } });
 Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return index_js_3.parseKeyValueList; } });

package/dist/otel/index.d.ts

@@ -1,2 +1,2 @@
 export type { SpanExporter } from "./exporter.js";
-export { OtlpHttpExporter, otlpExporterFromEnv, buildExportRequest, parseKeyValueList, type OtlpHttpExporterOptions, } from "./otlp-http.js";
+export { OtlpExporter, otlpExporterFromEnv, parseKeyValueList, toReadableSpan, type OtlpExporterOptions, type OtlpProtocol, } from "./otlp.js";

package/dist/otel/index.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseKeyValueList = exports.buildExportRequest = exports.otlpExporterFromEnv = exports.OtlpHttpExporter = void 0;
-var otlp_http_js_1 = require("./otlp-http.js");
-Object.defineProperty(exports, "OtlpHttpExporter", { enumerable: true, get: function () { return otlp_http_js_1.OtlpHttpExporter; } });
-Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return otlp_http_js_1.otlpExporterFromEnv; } });
-Object.defineProperty(exports, "buildExportRequest", { enumerable: true, get: function () { return otlp_http_js_1.buildExportRequest; } });
-Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return otlp_http_js_1.parseKeyValueList; } });
+exports.toReadableSpan = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = void 0;
+var otlp_js_1 = require("./otlp.js");
+Object.defineProperty(exports, "OtlpExporter", { enumerable: true, get: function () { return otlp_js_1.OtlpExporter; } });
+Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return otlp_js_1.otlpExporterFromEnv; } });
+Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return otlp_js_1.parseKeyValueList; } });
+Object.defineProperty(exports, "toReadableSpan", { enumerable: true, get: function () { return otlp_js_1.toReadableSpan; } });

package/dist/otel/otlp.d.ts

@@ -0,0 +1,91 @@
+/**
+ * OTLP exporter — SDK-backed.
+ *
+ * Bridges our internal `TraceSpan` records into the official OpenTelemetry
+ * SDK exporters from `@opentelemetry/exporter-trace-otlp-http` and
+ * `@opentelemetry/exporter-trace-otlp-proto`. Each completed `TraceSpan`
+ * is converted to a `ReadableSpan` shape and handed to the SDK exporter,
+ * which serializes (JSON or protobuf) and POSTs to an OTLP HTTP endpoint.
+ *
+ * Standard OTel env vars consumed by `otlpExporterFromEnv()`:
+ *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
+ *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
+ *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
+ *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    traces-specific headers
+ *   - OTEL_EXPORTER_OTLP_PROTOCOL          `http/protobuf` (default) or `http/json`
+ *   - OTEL_EXPORTER_OTLP_TRACES_PROTOCOL   traces-specific protocol
+ *   - OTEL_SERVICE_NAME                    service.name resource attribute
+ *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attributes
+ *   - ORY_OTLP_ENDPOINT                    Ory-prefixed alias for the dev launcher
+ *
+ * Failures are swallowed (callers receive a resolved Promise) so trace
+ * export can never break the agent session. Transport errors surface
+ * through the `onError` callback.
+ */
+import { type AttributeValue } from "@opentelemetry/api";
+import { type Resource } from "@opentelemetry/resources";
+import type { ReadableSpan } from "@opentelemetry/sdk-trace-base";
+import type { SpanExporter as SdkSpanExporter } from "@opentelemetry/sdk-trace-base";
+import type { SpanExporter } from "./exporter.js";
+import type { TraceSpan } from "../tracer.js";
+export type OtlpProtocol = "http/json" | "http/protobuf";
+export interface OtlpExporterOptions {
+    /** Full traces endpoint (e.g. `http://localhost:4318/v1/traces`). */
+    endpoint: string;
+    /** Wire protocol. Default: `http/protobuf` (the OTel spec default). */
+    protocol?: OtlpProtocol;
+    /** Additional HTTP headers to send with each request. */
+    headers?: Record<string, string>;
+    /** Resource attributes merged into every export. */
+    resource?: Record<string, AttributeValue>;
+    /** Per-request timeout in milliseconds. Default: 5000. */
+    timeoutMs?: number;
+    /** Optional sink for transport errors. Defaults to a no-op. */
+    onError?: (err: unknown) => void;
+    /**
+     * Inject a custom SDK exporter (used by tests). When provided, supersedes
+     * the protocol selector — the wrapper passes converted ReadableSpans to
+     * this exporter as-is.
+     */
+    sdkExporter?: SdkSpanExporter;
+}
+/**
+ * OTLP exporter that delegates wire-format serialization and HTTP transport
+ * to the official `@opentelemetry/exporter-trace-otlp-*` SDK exporters.
+ */
+export declare class OtlpExporter implements SpanExporter {
+    readonly endpoint: string;
+    readonly protocol: OtlpProtocol;
+    readonly headers: Record<string, string>;
+    readonly resource: Resource;
+    private readonly delegate;
+    private readonly onError;
+    private readonly inFlight;
+    constructor(opts: OtlpExporterOptions);
+    export(spans: ReadonlyArray<TraceSpan>): Promise<void>;
+    shutdown(): Promise<void>;
+}
+/**
+ * Build an OtlpExporter from process env. Returns undefined when no
+ * endpoint is configured or the requested protocol is unsupported.
+ */
+export declare function otlpExporterFromEnv(opts: {
+    harness: string;
+    hostname?: string;
+    user?: string;
+    pluginVersion?: string;
+    cwd?: string;
+    gitBranch?: string;
+    gitCommit?: string;
+    onError?: (err: unknown) => void;
+    env?: NodeJS.ProcessEnv;
+}): OtlpExporter | undefined;
+/**
+ * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
+ */
+export declare function parseKeyValueList(raw: string | undefined): Record<string, string>;
+/**
+ * Convert our internal `TraceSpan` record to an OTel SDK `ReadableSpan`.
+ * Exported for tests; the OTLP exporters consume this shape directly.
+ */
+export declare function toReadableSpan(span: TraceSpan, resource: Resource): ReadableSpan;

package/dist/otel/otlp.js

@@ -0,0 +1,348 @@
+"use strict";
+/**
+ * OTLP exporter — SDK-backed.
+ *
+ * Bridges our internal `TraceSpan` records into the official OpenTelemetry
+ * SDK exporters from `@opentelemetry/exporter-trace-otlp-http` and
+ * `@opentelemetry/exporter-trace-otlp-proto`. Each completed `TraceSpan`
+ * is converted to a `ReadableSpan` shape and handed to the SDK exporter,
+ * which serializes (JSON or protobuf) and POSTs to an OTLP HTTP endpoint.
+ *
+ * Standard OTel env vars consumed by `otlpExporterFromEnv()`:
+ *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
+ *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
+ *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
+ *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    traces-specific headers
+ *   - OTEL_EXPORTER_OTLP_PROTOCOL          `http/protobuf` (default) or `http/json`
+ *   - OTEL_EXPORTER_OTLP_TRACES_PROTOCOL   traces-specific protocol
+ *   - OTEL_SERVICE_NAME                    service.name resource attribute
+ *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attributes
+ *   - ORY_OTLP_ENDPOINT                    Ory-prefixed alias for the dev launcher
+ *
+ * Failures are swallowed (callers receive a resolved Promise) so trace
+ * export can never break the agent session. Transport errors surface
+ * through the `onError` callback.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OtlpExporter = void 0;
+exports.otlpExporterFromEnv = otlpExporterFromEnv;
+exports.parseKeyValueList = parseKeyValueList;
+exports.toReadableSpan = toReadableSpan;
+const api_1 = require("@opentelemetry/api");
+const core_1 = require("@opentelemetry/core");
+const resources_1 = require("@opentelemetry/resources");
+const exporter_trace_otlp_http_1 = require("@opentelemetry/exporter-trace-otlp-http");
+const exporter_trace_otlp_proto_1 = require("@opentelemetry/exporter-trace-otlp-proto");
+const TRACES_PATH = "/v1/traces";
+const SCOPE = {
+    name: "ory-agent-plugins",
+};
+/**
+ * OTLP exporter that delegates wire-format serialization and HTTP transport
+ * to the official `@opentelemetry/exporter-trace-otlp-*` SDK exporters.
+ */
+class OtlpExporter {
+    endpoint;
+    protocol;
+    headers;
+    resource;
+    delegate;
+    onError;
+    inFlight = new Set();
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.protocol = opts.protocol ?? "http/protobuf";
+        this.headers = { ...(opts.headers ?? {}) };
+        this.resource = (0, resources_1.resourceFromAttributes)(stripUndefined(opts.resource ?? {}));
+        this.onError = opts.onError ?? (() => undefined);
+        this.delegate =
+            opts.sdkExporter ??
+                buildSdkExporter(this.endpoint, this.protocol, this.headers, opts.timeoutMs);
+    }
+    export(spans) {
+        if (spans.length === 0)
+            return Promise.resolve();
+        const readables = spans.map((s) => toReadableSpan(s, this.resource));
+        const promise = new Promise((resolve) => {
+            try {
+                this.delegate.export(readables, (result) => {
+                    if (result.code !== core_1.ExportResultCode.SUCCESS) {
+                        this.onError(result.error ?? new Error("OTLP export failed"));
+                    }
+                    resolve();
+                });
+            }
+            catch (err) {
+                // Defensive — SDK exporter contract says export() must not throw,
+                // but we honor our own contract regardless.
+                this.onError(err);
+                resolve();
+            }
+        });
+        this.inFlight.add(promise);
+        promise.finally(() => this.inFlight.delete(promise));
+        return promise;
+    }
+    async shutdown() {
+        // Drain in-flight exports first. Subprocess hooks (claude-code, codex,
+        // gemini-cli) call process.exit() the instant they hand back stdout —
+        // without this drain the underlying HTTP request is killed mid-flight
+        // and spans never reach the collector even though the NDJSON file
+        // already contains them.
+        if (this.inFlight.size > 0) {
+            await Promise.allSettled([...this.inFlight]);
+        }
+        try {
+            await this.delegate.shutdown();
+        }
+        catch (err) {
+            this.onError(err);
+        }
+    }
+}
+exports.OtlpExporter = OtlpExporter;
+function buildSdkExporter(endpoint, protocol, headers, timeoutMs) {
+    const config = {
+        url: endpoint,
+        headers,
+        timeoutMillis: timeoutMs ?? 5_000,
+    };
+    return protocol === "http/json"
+        ? new exporter_trace_otlp_http_1.OTLPTraceExporter(config)
+        : new exporter_trace_otlp_proto_1.OTLPTraceExporter(config);
+}
+// ─── Factory ───────────────────────────────────────────────────────
+/**
+ * Build an OtlpExporter from process env. Returns undefined when no
+ * endpoint is configured or the requested protocol is unsupported.
+ */
+function otlpExporterFromEnv(opts) {
+    const env = opts.env ?? process.env;
+    const endpoint = resolveEndpoint(env);
+    if (!endpoint)
+        return undefined;
+    const protocol = resolveProtocol(env, opts.onError);
+    if (!protocol)
+        return undefined;
+    const headers = mergeHeaders(parseKeyValueList(env.OTEL_EXPORTER_OTLP_HEADERS), parseKeyValueList(env.OTEL_EXPORTER_OTLP_TRACES_HEADERS));
+    const resource = {
+        "service.name": env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${opts.harness}`,
+        "service.namespace": "ory.agent_plugins",
+        "ory.harness": opts.harness,
+        "process.pid": process.pid,
+        "process.runtime.name": "nodejs",
+        "process.runtime.version": process.version,
+    };
+    if (opts.hostname)
+        resource["host.name"] = opts.hostname;
+    if (opts.user)
+        resource["host.user"] = opts.user;
+    if (opts.pluginVersion)
+        resource["service.version"] = opts.pluginVersion;
+    if (opts.cwd)
+        resource["process.cwd"] = opts.cwd;
+    if (opts.gitBranch)
+        resource["ory.git.branch"] = opts.gitBranch;
+    if (opts.gitCommit)
+        resource["ory.git.commit"] = opts.gitCommit;
+    for (const [k, v] of Object.entries(parseKeyValueList(env.OTEL_RESOURCE_ATTRIBUTES))) {
+        resource[k] = v;
+    }
+    return new OtlpExporter({
+        endpoint,
+        protocol,
+        headers,
+        resource,
+        onError: opts.onError,
+    });
+}
+function resolveEndpoint(env) {
+    const tracesUrl = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+    if (tracesUrl)
+        return tracesUrl;
+    // ORY_OTLP_ENDPOINT is an Ory-prefixed alias used by the dev launcher.
+    // Some harnesses (e.g. Claude Code) filter the env they pass to hook
+    // subprocesses and drop OTEL_*-prefixed vars, but allow ORY_*-prefixed
+    // ones through. The alias lets the launcher hand the OTLP endpoint to
+    // the hook process without depending on OTEL_* propagation.
+    const base = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || env.ORY_OTLP_ENDPOINT?.trim();
+    if (!base)
+        return undefined;
+    return base.replace(/\/+$/, "") + TRACES_PATH;
+}
+function resolveProtocol(env, onError) {
+    const raw = (env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL ??
+        env.OTEL_EXPORTER_OTLP_PROTOCOL ??
+        "http/protobuf")
+        .trim()
+        .toLowerCase();
+    if (raw === "http/protobuf" || raw === "http/json")
+        return raw;
+    onError?.(new Error(`OTEL_EXPORTER_OTLP_PROTOCOL=${raw} not supported (only http/protobuf and http/json). Skipping OTel export.`));
+    return undefined;
+}
+// ─── Env parsing helpers ───────────────────────────────────────────
+/**
+ * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
+ */
+function parseKeyValueList(raw) {
+    const out = {};
+    if (!raw)
+        return out;
+    for (const pair of raw.split(",")) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const key = trimmed.slice(0, eq).trim();
+        const value = trimmed.slice(eq + 1).trim();
+        if (!key)
+            continue;
+        out[key] = safeDecodeURIComponent(value);
+    }
+    return out;
+}
+function safeDecodeURIComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+function mergeHeaders(...sources) {
+    const out = {};
+    for (const src of sources) {
+        for (const [k, v] of Object.entries(src)) {
+            out[k.toLowerCase()] = v;
+        }
+    }
+    return out;
+}
+// ─── TraceSpan → ReadableSpan conversion ───────────────────────────
+/**
+ * Convert our internal `TraceSpan` record to an OTel SDK `ReadableSpan`.
+ * Exported for tests; the OTLP exporters consume this shape directly.
+ */
+function toReadableSpan(span, resource) {
+    // OTLP wire format expects 32-hex traceId / 16-hex spanId. Our internal
+    // IDs are shorter (hashed session prefix + random suffix), so pad with
+    // leading zeros to canonical width.
+    const traceId = padHex(span.traceId, 32);
+    const spanId = padHex(span.spanId, 16);
+    const ctx = {
+        traceId,
+        spanId,
+        traceFlags: 1, // sampled
+        isRemote: false,
+    };
+    const parentSpanContext = span.parentSpanId
+        ? {
+            traceId,
+            spanId: padHex(span.parentSpanId, 16),
+            traceFlags: 1,
+            isRemote: false,
+        }
+        : undefined;
+    const startTime = isoToHrTime(span.startedAt);
+    const endTime = isoToHrTime(span.endedAt);
+    const attributes = {
+        "ory.event": span.event,
+        "ory.span.status": span.status,
+        "ory.duration_ms": span.durationMs,
+    };
+    if (span.sessionId)
+        attributes["ory.session_id"] = span.sessionId;
+    for (const [k, v] of Object.entries(flattenAttributes(span.attributes ?? {}))) {
+        attributes[k] = v;
+    }
+    return {
+        name: span.event,
+        kind: api_1.SpanKind.INTERNAL,
+        spanContext: () => ctx,
+        parentSpanContext,
+        startTime,
+        endTime,
+        status: toOtelStatus(span.status),
+        attributes,
+        links: [],
+        events: [],
+        duration: hrTimeSubtract(endTime, startTime),
+        ended: true,
+        resource,
+        instrumentationScope: SCOPE,
+        droppedAttributesCount: 0,
+        droppedEventsCount: 0,
+        droppedLinksCount: 0,
+    };
+}
+function toOtelStatus(status) {
+    switch (status) {
+        case "ok":
+            return { code: api_1.SpanStatusCode.OK };
+        case "error":
+            return { code: api_1.SpanStatusCode.ERROR, message: "error" };
+        case "denied":
+            return { code: api_1.SpanStatusCode.ERROR, message: "denied" };
+        case "skipped":
+        default:
+            return { code: api_1.SpanStatusCode.UNSET };
+    }
+}
+function isoToHrTime(iso) {
+    const ms = Date.parse(iso);
+    if (!Number.isFinite(ms))
+        return [0, 0];
+    const seconds = Math.trunc(ms / 1000);
+    const nanos = (ms - seconds * 1000) * 1_000_000;
+    return [seconds, nanos];
+}
+function hrTimeSubtract(a, b) {
+    let sec = a[0] - b[0];
+    let nanos = a[1] - b[1];
+    if (nanos < 0) {
+        sec -= 1;
+        nanos += 1_000_000_000;
+    }
+    if (sec < 0) {
+        return [0, 0];
+    }
+    return [sec, nanos];
+}
+function padHex(hex, length) {
+    const lower = hex.toLowerCase().replace(/[^0-9a-f]/g, "");
+    if (lower.length >= length)
+        return lower.slice(-length);
+    return lower.padStart(length, "0");
+}
+function flattenAttributes(attrs) {
+    const out = {};
+    for (const [key, value] of Object.entries(attrs)) {
+        if (value === null || value === undefined)
+            continue;
+        if (typeof value === "string" ||
+            typeof value === "number" ||
+            typeof value === "boolean") {
+            out[key] = value;
+            continue;
+        }
+        try {
+            out[key] = JSON.stringify(value);
+        }
+        catch {
+            /* skip un-serializable values */
+        }
+    }
+    return out;
+}
+function stripUndefined(source) {
+    const out = {};
+    for (const [k, v] of Object.entries(source)) {
+        if (v === undefined)
+            continue;
+        out[k] = v;
+    }
+    return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -65,6 +65,12 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/core": "^2.8.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.219.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
+    "@opentelemetry/resources": "^2.8.0",
+    "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@ory/client": "^1.22.37",
     "open": "^11.0.0"
   },

package/dist/otel/otlp-http.d.ts

@@ -1,116 +0,0 @@
-/**
- * OTLP/HTTP JSON exporter.
- *
- * Serializes TraceSpan records into the OTLP ExportTraceServiceRequest
- * shape and POSTs them to an OTLP HTTP endpoint as JSON. Works with
- * Jaeger's OTLP receiver, Grafana Tempo, OpenTelemetry Collector,
- * Honeycomb, and any other vendor that accepts OTLP/HTTP.
- *
- * No protobuf dependency — relies on the global `fetch`. The exporter
- * is intentionally side-effect-free: failures are swallowed (callers
- * receive a resolved Promise) so trace export can never break the
- * agent session.
- *
- * Standard env vars consumed by `otlpExporterFromEnv()`:
- *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
- *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
- *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
- *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    headers specific to traces
- *   - OTEL_SERVICE_NAME                    service.name resource attribute
- *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attrs
- */
-import type { SpanExporter } from "./exporter.js";
-import type { TraceSpan } from "../tracer.js";
-export interface OtlpHttpExporterOptions {
-    /** Full traces endpoint (e.g. `http://localhost:4318/v1/traces`). */
-    endpoint: string;
-    /** Additional HTTP headers to send with each request. */
-    headers?: Record<string, string>;
-    /** Resource attributes (service.name, host.name, …) merged into every export. */
-    resource?: Record<string, AttributeValue>;
-    /** Per-request timeout in milliseconds. Default: 5000. */
-    timeoutMs?: number;
-    /** Optional sink for transport errors. Defaults to a no-op. */
-    onError?: (err: unknown) => void;
-    /**
-     * Override the fetch function (used by tests). Defaults to global fetch.
-     */
-    fetch?: typeof fetch;
-}
-export declare class OtlpHttpExporter implements SpanExporter {
-    private readonly endpoint;
-    private readonly headers;
-    private readonly resource;
-    private readonly timeoutMs;
-    private readonly onError;
-    private readonly fetchImpl;
-    private readonly inFlight;
-    constructor(opts: OtlpHttpExporterOptions);
-    export(spans: ReadonlyArray<TraceSpan>): Promise<void>;
-    private send;
-    shutdown(): Promise<void>;
-}
-/**
- * Build an OtlpHttpExporter from process env. Returns undefined when no
- * endpoint is configured.
- */
-export declare function otlpExporterFromEnv(opts: {
-    harness: string;
-    hostname?: string;
-    user?: string;
-    pluginVersion?: string;
-    cwd?: string;
-    gitBranch?: string;
-    gitCommit?: string;
-    onError?: (err: unknown) => void;
-    env?: NodeJS.ProcessEnv;
-}): OtlpHttpExporter | undefined;
-/**
- * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
- */
-export declare function parseKeyValueList(raw: string | undefined): Record<string, string>;
-type AttributeValue = string | number | boolean | null | undefined;
-interface OtlpKeyValue {
-    key: string;
-    value: OtlpAnyValue;
-}
-interface OtlpAnyValue {
-    stringValue?: string;
-    intValue?: string;
-    doubleValue?: number;
-    boolValue?: boolean;
-    arrayValue?: {
-        values: OtlpAnyValue[];
-    };
-}
-interface OtlpStatus {
-    code: 0 | 1 | 2;
-    message?: string;
-}
-interface OtlpSpan {
-    traceId: string;
-    spanId: string;
-    parentSpanId?: string;
-    name: string;
-    kind: number;
-    startTimeUnixNano: string;
-    endTimeUnixNano: string;
-    attributes?: OtlpKeyValue[];
-    status?: OtlpStatus;
-}
-interface OtlpResourceSpans {
-    resource: {
-        attributes: OtlpKeyValue[];
-    };
-    scopeSpans: Array<{
-        scope: {
-            name: string;
-        };
-        spans: OtlpSpan[];
-    }>;
-}
-interface OtlpExportRequest {
-    resourceSpans: OtlpResourceSpans[];
-}
-export declare function buildExportRequest(spans: ReadonlyArray<TraceSpan>, resource: Record<string, AttributeValue>): OtlpExportRequest;
-export {};

package/dist/otel/otlp-http.js

@@ -1,322 +0,0 @@
-"use strict";
-/**
- * OTLP/HTTP JSON exporter.
- *
- * Serializes TraceSpan records into the OTLP ExportTraceServiceRequest
- * shape and POSTs them to an OTLP HTTP endpoint as JSON. Works with
- * Jaeger's OTLP receiver, Grafana Tempo, OpenTelemetry Collector,
- * Honeycomb, and any other vendor that accepts OTLP/HTTP.
- *
- * No protobuf dependency — relies on the global `fetch`. The exporter
- * is intentionally side-effect-free: failures are swallowed (callers
- * receive a resolved Promise) so trace export can never break the
- * agent session.
- *
- * Standard env vars consumed by `otlpExporterFromEnv()`:
- *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
- *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
- *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
- *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    headers specific to traces
- *   - OTEL_SERVICE_NAME                    service.name resource attribute
- *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attrs
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OtlpHttpExporter = void 0;
-exports.otlpExporterFromEnv = otlpExporterFromEnv;
-exports.parseKeyValueList = parseKeyValueList;
-exports.buildExportRequest = buildExportRequest;
-const TRACES_PATH = "/v1/traces";
-const SCOPE_NAME = "ory-agent-plugins";
-class OtlpHttpExporter {
-    endpoint;
-    headers;
-    resource;
-    timeoutMs;
-    onError;
-    fetchImpl;
-    inFlight = new Set();
-    constructor(opts) {
-        this.endpoint = opts.endpoint;
-        this.headers = { "content-type": "application/json", ...opts.headers };
-        this.resource = opts.resource ?? {};
-        this.timeoutMs = opts.timeoutMs ?? 5_000;
-        this.onError = opts.onError ?? (() => undefined);
-        this.fetchImpl = opts.fetch ?? globalThis.fetch;
-    }
-    export(spans) {
-        if (spans.length === 0)
-            return Promise.resolve();
-        if (typeof this.fetchImpl !== "function") {
-            this.onError(new Error("global fetch is not available"));
-            return Promise.resolve();
-        }
-        const promise = this.send(spans);
-        this.inFlight.add(promise);
-        promise.finally(() => this.inFlight.delete(promise));
-        return promise;
-    }
-    async send(spans) {
-        const payload = buildExportRequest(spans, this.resource);
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-        try {
-            const response = await this.fetchImpl(this.endpoint, {
-                method: "POST",
-                headers: this.headers,
-                body: JSON.stringify(payload),
-                signal: controller.signal,
-            });
-            if (!response.ok) {
-                // Drain body so the connection can be reused but ignore the value.
-                try {
-                    await response.text();
-                }
-                catch {
-                    /* ignore */
-                }
-                this.onError(new Error(`OTLP export failed with status ${response.status}`));
-            }
-        }
-        catch (err) {
-            this.onError(err);
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    async shutdown() {
-        // Drain in-flight exports. Subprocess hooks (claude-code, codex,
-        // gemini-cli) call process.exit() the instant they hand back stdout —
-        // without this drain the OTLP fetch is killed mid-flight and spans
-        // never reach the collector even though the NDJSON file already
-        // contains them.
-        if (this.inFlight.size === 0)
-            return;
-        await Promise.allSettled([...this.inFlight]);
-    }
-}
-exports.OtlpHttpExporter = OtlpHttpExporter;
-/**
- * Build an OtlpHttpExporter from process env. Returns undefined when no
- * endpoint is configured.
- */
-function otlpExporterFromEnv(opts) {
-    const env = opts.env ?? process.env;
-    const endpoint = resolveEndpoint(env);
-    if (!endpoint)
-        return undefined;
-    const protocol = env.OTEL_EXPORTER_OTLP_PROTOCOL ?? env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL;
-    if (protocol && protocol !== "http/json") {
-        opts.onError?.(new Error(`OTEL_EXPORTER_OTLP_PROTOCOL=${protocol} not supported (only http/json). Skipping OTel export.`));
-        return undefined;
-    }
-    const headers = mergeHeaders(parseKeyValueList(env.OTEL_EXPORTER_OTLP_HEADERS), parseKeyValueList(env.OTEL_EXPORTER_OTLP_TRACES_HEADERS));
-    const resource = {
-        "service.name": env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${opts.harness}`,
-        "service.namespace": "ory.agent_plugins",
-        "ory.harness": opts.harness,
-        "process.pid": process.pid,
-        "process.runtime.name": "nodejs",
-        "process.runtime.version": process.version,
-    };
-    if (opts.hostname)
-        resource["host.name"] = opts.hostname;
-    if (opts.user)
-        resource["host.user"] = opts.user;
-    if (opts.pluginVersion) {
-        resource["service.version"] = opts.pluginVersion;
-    }
-    if (opts.cwd)
-        resource["process.cwd"] = opts.cwd;
-    if (opts.gitBranch)
-        resource["ory.git.branch"] = opts.gitBranch;
-    if (opts.gitCommit)
-        resource["ory.git.commit"] = opts.gitCommit;
-    for (const [k, v] of Object.entries(parseKeyValueList(env.OTEL_RESOURCE_ATTRIBUTES))) {
-        resource[k] = v;
-    }
-    return new OtlpHttpExporter({
-        endpoint,
-        headers,
-        resource,
-        onError: opts.onError,
-    });
-}
-// ─── Endpoint / header parsing ─────────────────────────────────────
-function resolveEndpoint(env) {
-    const tracesUrl = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
-    if (tracesUrl) {
-        // User specified the full traces URL — use as-is.
-        return tracesUrl;
-    }
-    // ORY_OTLP_ENDPOINT is an ORY-prefixed alias used by the dev launcher.
-    // Some harnesses (e.g. Claude Code) filter the env they pass to hook
-    // subprocesses and drop OTEL_*-prefixed vars, but allow ORY_*-prefixed
-    // ones through. The alias lets the launcher hand the OTLP endpoint to
-    // the hook process without depending on OTEL_* propagation.
-    const base = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || env.ORY_OTLP_ENDPOINT?.trim();
-    if (!base)
-        return undefined;
-    return base.replace(/\/+$/, "") + TRACES_PATH;
-}
-/**
- * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
- */
-function parseKeyValueList(raw) {
-    const out = {};
-    if (!raw)
-        return out;
-    for (const pair of raw.split(",")) {
-        const trimmed = pair.trim();
-        if (!trimmed)
-            continue;
-        const eq = trimmed.indexOf("=");
-        if (eq <= 0)
-            continue;
-        const key = trimmed.slice(0, eq).trim();
-        const value = trimmed.slice(eq + 1).trim();
-        if (!key)
-            continue;
-        out[key] = safeDecodeURIComponent(value);
-    }
-    return out;
-}
-function safeDecodeURIComponent(value) {
-    try {
-        return decodeURIComponent(value);
-    }
-    catch {
-        return value;
-    }
-}
-function mergeHeaders(...sources) {
-    const out = {};
-    for (const src of sources) {
-        for (const [k, v] of Object.entries(src)) {
-            out[k.toLowerCase()] = v;
-        }
-    }
-    return out;
-}
-function buildExportRequest(spans, resource) {
-    const otlpSpans = spans.map(toOtlpSpan);
-    return {
-        resourceSpans: [
-            {
-                resource: { attributes: toAttributes(resource) },
-                scopeSpans: [
-                    {
-                        scope: { name: SCOPE_NAME },
-                        spans: otlpSpans,
-                    },
-                ],
-            },
-        ],
-    };
-}
-function toOtlpSpan(span) {
-    // OTLP/HTTP JSON expects 32-hex traceId and 16-hex spanId per the
-    // proto3-JSON canonical mapping with hex string encoding (the OTel
-    // spec also allows base64; modern collectors and Honeycomb accept
-    // hex). Pad short ids with leading zeros.
-    const status = toOtlpStatus(span.status);
-    const baseAttributes = {
-        "ory.event": span.event,
-        "ory.span.status": span.status,
-        "ory.duration_ms": span.durationMs,
-    };
-    if (span.sessionId)
-        baseAttributes["ory.session_id"] = span.sessionId;
-    const flat = flattenAttributes(span.attributes ?? {});
-    const attrs = { ...baseAttributes, ...flat };
-    return {
-        traceId: padHex(span.traceId, 32),
-        spanId: padHex(span.spanId, 16),
-        ...(span.parentSpanId
-            ? { parentSpanId: padHex(span.parentSpanId, 16) }
-            : {}),
-        name: span.event,
-        kind: 1, // SPAN_KIND_INTERNAL
-        startTimeUnixNano: isoToUnixNano(span.startedAt),
-        endTimeUnixNano: isoToUnixNano(span.endedAt),
-        attributes: toAttributes(attrs),
-        ...(status ? { status } : {}),
-    };
-}
-function toOtlpStatus(status) {
-    switch (status) {
-        case "ok":
-            return { code: 1 };
-        case "error":
-            return { code: 2, message: "error" };
-        case "denied":
-            return { code: 2, message: "denied" };
-        case "skipped":
-            return undefined; // STATUS_CODE_UNSET
-        default:
-            return undefined;
-    }
-}
-function isoToUnixNano(iso) {
-    const ms = Date.parse(iso);
-    if (!Number.isFinite(ms))
-        return "0";
-    // BigInt avoids 2^53 rounding for ns timestamps.
-    return (BigInt(ms) * 1000000n).toString();
-}
-function padHex(hex, length) {
-    const lower = hex.toLowerCase().replace(/[^0-9a-f]/g, "");
-    if (lower.length >= length)
-        return lower.slice(-length);
-    return lower.padStart(length, "0");
-}
-function toAttributes(source) {
-    const out = [];
-    for (const [key, value] of Object.entries(source)) {
-        const v = toAnyValue(value);
-        if (v)
-            out.push({ key, value: v });
-    }
-    return out;
-}
-function toAnyValue(value) {
-    if (value === null || value === undefined)
-        return undefined;
-    if (typeof value === "string")
-        return { stringValue: value };
-    if (typeof value === "boolean")
-        return { boolValue: value };
-    if (typeof value === "number") {
-        if (Number.isInteger(value)) {
-            return { intValue: value.toString() };
-        }
-        return { doubleValue: value };
-    }
-    return undefined;
-}
-/**
- * Flatten nested attribute objects into a single-level Record where
- * complex values are JSON-stringified. Keeps OTLP attributes compact
- * and queryable as scalars in vendor backends.
- */
-function flattenAttributes(attrs) {
-    const out = {};
-    for (const [key, value] of Object.entries(attrs)) {
-        if (value === null || value === undefined)
-            continue;
-        if (typeof value === "string" ||
-            typeof value === "number" ||
-            typeof value === "boolean") {
-            out[key] = value;
-        }
-        else {
-            try {
-                out[key] = JSON.stringify(value);
-            }
-            catch {
-                /* skip un-serializable values */
-            }
-        }
-    }
-    return out;
-}