@ory/argus 1.0.1 → 1.2.0

package/dist/status-data.js

@@ -50,7 +50,6 @@ exports.collectStatusReport = collectStatusReport;
  */
 const config_js_1 = require("./config.js");
 const permission_mode_js_1 = require("./permission-mode.js");
-const permissions_js_1 = require("./permissions.js");
 const auth_store_js_1 = require("./auth-store.js");
 const agent_auth_js_1 = require("./agent-auth.js");
 const subject_js_1 = require("./subject.js");
@@ -69,14 +68,13 @@ function resolveNamespace() {
 }
 /**
  * Probe the harness's built-in tool catalog against Ory, returning how many
- * tools the resolved user subject is allowed / denied / errored on, plus the
+ * tools the resolved user subject is allowed / blocked / errored on, plus the
  * live permission mode and the subject that was checked. Returns undefined when
  * a probe can't run (no project URL, empty catalog, no user identity). Never
  * throws.
  *
- * Checks route through {@link resolveCheckRelation}, i.e. the `access` permit —
- * the same relation the runtime gate evaluates — so a tool carrying an explicit
- * block is reported as denied here too, exactly as a tool call would be.
+ * Checks use the same default-allow `use` permit as the runtime gate. A false
+ * result therefore means an explicit block, not missing grant coverage.
  */
 async function probePermissionsCoverage(harness) {
     const resolved = (0, config_js_1.resolveConfig)();
@@ -106,10 +104,11 @@ async function probePermissionsCoverage(harness) {
         additionalSubjects: agentSubject ? [{ scope: "agent", subject: agentSubject }] : [],
     });
     const namespace = resolveNamespace();
-    const relation = (0, permissions_js_1.resolveCheckRelation)("users");
+    const relation = opl_js_1.PERMIT_USE;
     const result = {
         total: catalog.length,
         allowed: 0,
+        blocked: 0,
         denied: 0,
         errored: 0,
         mode: live.mode,
@@ -124,8 +123,10 @@ async function probePermissionsCoverage(harness) {
             });
             if (probe.allowed)
                 result.allowed++;
-            else
+            else {
+                result.blocked++;
                 result.denied++;
+            }
         }
         catch (err) {
             const ory = err;
@@ -274,14 +275,14 @@ async function collectPermissions(harness) {
         return { ...base, coverageStatus: "no_user" };
     // The probe read the mode live; prefer it over the cached config value.
     const withMode = { ...base, mode: coverage.mode, modeSource: coverage.modeSource };
-    if (coverage.errored > 0 && coverage.allowed === 0 && coverage.denied === 0) {
+    if (coverage.errored > 0 && coverage.allowed === 0 && coverage.blocked === 0) {
         return { ...withMode, coverageStatus: "probe_failed", coverage };
     }
     const status = coverage.allowed === coverage.total
-        ? "fully_granted"
+        ? "fully_allowed"
         : coverage.allowed === 0
-            ? "no_grants"
-            : "partial";
+            ? "fully_blocked"
+            : "partially_blocked";
     return { ...withMode, coverageStatus: status, coverage };
 }
 function isUserTokenUsable() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",