@ory/argus 1.1.0 → 1.2.0

package/dist/auth.d.ts

@@ -52,6 +52,8 @@ export interface PkceLoginOptions {
     isHeadless?: () => boolean;
     /** Optional AbortSignal to cancel the login (e.g. on shutdown). */
     signal?: AbortSignal;
+    /** @internal Injectable seam for testing default-fetch TLS setup. */
+    configureSystemCaTrust?: () => void;
 }
 export type PkceLoginOutcome = {
     kind: "ok";
@@ -119,6 +121,8 @@ export declare function refreshAccessToken(args: {
     projectUrl: string;
     clientId: string;
     refreshToken: string;
+    /** @internal Injectable seam for testing default-fetch TLS setup. */
+    configureSystemCaTrust?: () => void;
 }): Promise<OryOAuth2Tokens>;
 /**
  * Best-effort human-readable name for the signed-in user, pulled from the

package/dist/auth.js

@@ -60,6 +60,7 @@ const node_url_1 = require("node:url");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const branding_js_1 = require("./branding.js");
+const runtime_credential_js_1 = require("./runtime-credential.js");
 /** Loopback ports tried in order. All must be registered as redirect URIs on the Ory OAuth2 client. */
 exports.LOOPBACK_PORTS = [47823, 47824, 47825, 47826];
 /**
@@ -202,6 +203,7 @@ async function runPkceAttempt(options, scope, scopeFallbackPending) {
             redirectUri,
             code: result.code,
             codeVerifier,
+            configureSystemCaTrust: options.configureSystemCaTrust,
         });
         return { kind: "ok", tokens };
     }
@@ -516,6 +518,7 @@ async function exchangeCodeForTokens(args) {
         code_verifier: args.codeVerifier,
     });
     const tokenUrl = new node_url_1.URL("/oauth2/token", args.projectUrl).toString();
+    (args.configureSystemCaTrust ?? runtime_credential_js_1.configureSystemCaTrustForDefaultFetch)();
     const res = await fetch(tokenUrl, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -558,6 +561,7 @@ async function refreshAccessToken(args) {
         refresh_token: args.refreshToken,
     });
     const tokenUrl = new node_url_1.URL("/oauth2/token", args.projectUrl).toString();
+    (args.configureSystemCaTrust ?? runtime_credential_js_1.configureSystemCaTrustForDefaultFetch)();
     const res = await fetch(tokenUrl, {
         method: "POST",
         headers: { "content-type": "application/x-www-form-urlencoded" },

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "fc87fd73772d79007d1072c605ede76de42792ce",
-  "commitShort": "fc87fd7",
+  "commit": "f046260973bf9257c98d5a06e1d6e945f3c291e5",
+  "commitShort": "f046260",
   "branch": "main",
-  "commitDate": "2026-08-30T17:10:01-07:00",
+  "commitDate": "2026-09-01T17:01:44-07:00",
   "dirty": false,
-  "builtAt": "2026-08-31T00:13:34.583Z"
+  "builtAt": "2026-09-02T00:05:01.245Z"
 }

package/dist/opl.js

@@ -415,7 +415,8 @@ function buildAgentSecurityOpl(namespace = exports.DEFAULT_NAMESPACE, shellNames
         renderDelegationNamespaceClass(),
         "",
         "// Registered credential groups used to apply posture by harness or sub-agent type.",
-        renderAgentTypeNamespaceClass(exports.AGENT_TYPE_NAMESPACE, subject_js_1.AGENT_NAMESPACE),
+        "// Delegated Sub-Agents also belong to their parent harness group.",
+        renderAgentTypeNamespaceClass(exports.AGENT_TYPE_NAMESPACE, `${subject_js_1.AGENT_NAMESPACE} | ${subject_js_1.SUBAGENT_NAMESPACE}`),
         "",
         renderAgentTypeNamespaceClass(exports.SUBAGENT_TYPE_NAMESPACE, subject_js_1.SUBAGENT_NAMESPACE),
         "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",