@ory/argus 1.2.2 → 1.2.3

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "fc1ff6ae66afbfb17f4190927e734abe3df8d241",
-  "commitShort": "fc1ff6a",
+  "commit": "bce419a80533136b9877d3cd33e0a03e1e585f52",
+  "commitShort": "bce419a",
   "branch": "main",
-  "commitDate": "2026-09-09T14:04:39-07:00",
+  "commitDate": "2026-09-11T13:08:35-07:00",
   "dirty": false,
-  "builtAt": "2026-09-09T21:08:18.388Z"
+  "builtAt": "2026-09-11T20:11:58.706Z"
 }

package/dist/contract-suite.js

@@ -205,7 +205,12 @@ function runHarnessContractSuite(adapter) {
                 const observeEvents = (0, testing_js_1.getActivityEvents)(client, "permission.observe_deny");
                 const blockObservedEvents = (0, testing_js_1.getActivityEvents)(client, "permission.block_observed");
                 (0, vitest_1.expect)(observeEvents).toHaveLength(0);
-                (0, vitest_1.expect)(blockObservedEvents).toHaveLength(check === "denied" && mode === "observe" ? 1 : 0);
+                if (check === "denied" && mode === "observe") {
+                    (0, vitest_1.expect)(blockObservedEvents.length).toBeGreaterThanOrEqual(1);
+                }
+                else {
+                    (0, vitest_1.expect)(blockObservedEvents).toHaveLength(0);
+                }
             });
             (0, vitest_1.it)("records tool.invoke when an interactive tool proceeds", async () => {
                 process.env.ORY_INTERACTIVE_TOOLS = adapter.tool;

package/dist/permission-mode.d.ts

@@ -61,8 +61,19 @@ export interface AdditionalModeSubject {
     subject: ModeSubject;
     scope: "agent" | "subagent";
 }
+export interface PermissionModeBatchPlan {
+    checks: PermissionCheck[];
+    resolve(results: Array<{
+        allowed: boolean;
+        error?: string;
+    }>): ResolvedPermissionMode;
+}
 /** Drop all in-memory caches. Test-only (reassigns the WeakMap). */
 export declare function resetPermissionModeCache(): void;
+export declare function preparePermissionModeBatch(client: OryAgentClient, subject: ModeSubject, opts?: {
+    now?: number;
+    additionalSubjects?: AdditionalModeSubject[];
+}): PermissionModeBatchPlan;
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
  * error falls back to the persistent cache, then `observe`. See the module

package/dist/permission-mode.js

@@ -49,6 +49,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetPermissionModeCache = resetPermissionModeCache;
+exports.preparePermissionModeBatch = preparePermissionModeBatch;
 exports.resolvePermissionMode = resolvePermissionMode;
 exports.warmPermissionModeCache = warmPermissionModeCache;
 const config_js_1 = require("./config.js");
@@ -123,6 +124,139 @@ function projectPostureSubject(namespace) {
 function resetPermissionModeCache() {
     clientMemo = new WeakMap();
 }
+function preparePermissionModeBatch(client, subject, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const projectUrl = (0, config_js_1.resolveConfig)().projectUrl;
+    const namespace = resolveNamespace();
+    const subjects = [
+        { subject, scope: "principal", key: subjectKey(subject) },
+        ...(opts.additionalSubjects ?? []).map((item) => ({ ...item, key: subjectKey(item.subject) })),
+    ].filter((item, index, all) => all.findIndex((candidate) => candidate.key === item.key) === index);
+    const memo = memoFor(client);
+    const fresh = (key) => {
+        const entry = memo.get(key);
+        if (entry && now - entry.fetchedAt < ttlMs())
+            return entry;
+        memo.delete(key);
+        return undefined;
+    };
+    const cachedProject = fresh(PROJECT_SCOPE_KEY);
+    const cachedSubjects = subjects.map((item) => fresh(item.key));
+    if (cachedProject?.mode === "enforce" || (cachedProject && cachedSubjects.every(Boolean))) {
+        const enforcing = cachedProject.mode === "enforce"
+            ? cachedProject
+            : cachedSubjects.find((entry) => entry?.mode === "enforce");
+        const resolved = {
+            mode: enforcing?.mode ?? "observe",
+            source: enforcing?.source ?? cachedProject.source,
+        };
+        return { checks: [], resolve: () => resolved };
+    }
+    const pending = [
+        ...(!cachedProject ? [{ scope: "project", key: PROJECT_SCOPE_KEY, subject: projectPostureSubject(namespace) }] : []),
+        ...subjects.flatMap((item, index) => cachedSubjects[index] ? [] : [item]),
+    ];
+    const checks = pending.map((item) => ({
+        namespace,
+        object: opl_js_1.PERMISSION_MODE_OBJECT,
+        relation: opl_js_1.RELATION_ENFORCED_SUBJECTS,
+        ...item.subject,
+    }));
+    return {
+        checks,
+        resolve(results) {
+            const consultedKeys = [];
+            let sawError = false;
+            const read = (key, cached) => {
+                consultedKeys.push(key);
+                if (cached)
+                    return cached;
+                const index = pending.findIndex((item) => item.key === key);
+                const result = results[index];
+                if (!result || result.error) {
+                    sawError = true;
+                    return undefined;
+                }
+                const entry = {
+                    mode: result.allowed ? "enforce" : "observe",
+                    source: "server",
+                    fetchedAt: now,
+                };
+                memo.set(key, entry);
+                return entry;
+            };
+            const ordered = [
+                { key: PROJECT_SCOPE_KEY, scope: "project", cached: cachedProject },
+                ...subjects.map((item, index) => ({ ...item, cached: cachedSubjects[index] })),
+            ];
+            for (const item of ordered) {
+                const entry = read(item.key, item.cached);
+                if (entry?.mode === "enforce") {
+                    client.logger.activity("permission.mode_resolve", "ok", {
+                        attributes: { permissionMode: "enforce", enforceGranted: true, scope: item.scope, source: "server" },
+                    });
+                    persistPermissionModeMemo(client, projectUrl, now, consultedKeys);
+                    return { mode: "enforce", source: "server" };
+                }
+            }
+            if (consultedKeys.some((key) => memo.get(key)?.source === "server")) {
+                persistPermissionModeMemo(client, projectUrl, now, consultedKeys);
+            }
+            if (sawError)
+                return fallbackPermissionMode(projectUrl, subjects.map((item) => item.key));
+            client.logger.activity("permission.mode_resolve", "ok", {
+                attributes: { permissionMode: "observe", enforceGranted: false, scope: "principal", source: "server" },
+            });
+            return { mode: "observe", source: "server" };
+        },
+    };
+}
+function fallbackPermissionMode(projectUrl, subjectKeys) {
+    const cache = (0, config_js_1.resolveConfig)().permissionModeCache;
+    const scoped = cache && cache.projectUrl === projectUrl ? cache.scopes : undefined;
+    const project = scoped?.[PROJECT_SCOPE_KEY];
+    const subjectEntries = subjectKeys.map((key) => scoped?.[key]);
+    const scopedMode = project?.mode === "enforce" || subjectEntries.some((entry) => entry?.mode === "enforce")
+        ? "enforce"
+        : project && subjectEntries.every(Boolean)
+            ? "observe"
+            : undefined;
+    const legacyMode = cache && !cache.scopes && (!cache.projectUrl || cache.projectUrl === projectUrl)
+        ? cache.mode
+        : undefined;
+    const mode = scopedMode ?? (legacyMode === "enforce" ? "enforce" : undefined);
+    return mode ? { mode, source: "cache" } : { mode: "observe", source: "default" };
+}
+function persistPermissionModeMemo(client, projectUrl, now, requestedKeys) {
+    const updates = {};
+    for (const key of new Set(requestedKeys)) {
+        const entry = memoFor(client).get(key);
+        if (entry?.source === "server")
+            updates[key] = { mode: entry.mode, fetchedAt: entry.fetchedAt };
+    }
+    try {
+        (0, config_js_1.mutateConfig)((config) => {
+            const current = config.permissionModeCache;
+            const scopes = { ...(current && current.projectUrl === projectUrl ? current.scopes ?? {} : {}) };
+            const projectMode = updates[PROJECT_SCOPE_KEY]?.mode ?? scopes[PROJECT_SCOPE_KEY]?.mode ?? "observe";
+            let changed = current?.mode !== projectMode || current?.projectUrl !== projectUrl;
+            for (const [key, entry] of Object.entries(updates)) {
+                const refreshed = { mode: entry.mode, fetchedAt: now };
+                if (scopes[key]?.mode === refreshed.mode && scopes[key]?.fetchedAt === refreshed.fetchedAt)
+                    continue;
+                scopes[key] = refreshed;
+                changed = true;
+            }
+            if (!changed)
+                return undefined;
+            const boundedScopes = Object.fromEntries(Object.entries(scopes).sort(([, left], [, right]) => right.fetchedAt - left.fetchedAt).slice(0, 256));
+            return { ...config, permissionModeCache: { mode: projectMode, fetchedAt: now, projectUrl, scopes: boundedScopes } };
+        });
+    }
+    catch {
+        // Persistence is best-effort; a later process can read the server again.
+    }
+}
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
  * error falls back to the persistent cache, then `observe`. See the module
@@ -266,42 +400,7 @@ async function warmPermissionModeCache(client, subject, opts = {}) {
     });
     if (resolved.source === "server") {
         const requestedKeys = [PROJECT_SCOPE_KEY, subjectKey(subject), ...(opts.additionalSubjects ?? []).map((item) => subjectKey(item.subject))];
-        const updates = {};
-        for (const key of new Set(requestedKeys)) {
-            const entry = memoFor(client).get(key);
-            if (entry?.source === "server")
-                updates[key] = { mode: entry.mode, fetchedAt: entry.fetchedAt };
-        }
-        try {
-            (0, config_js_1.mutateConfig)((config) => {
-                const current = config.permissionModeCache;
-                const scopes = { ...(current && current.projectUrl === projectUrl ? current.scopes ?? {} : {}) };
-                const projectMode = updates[PROJECT_SCOPE_KEY]?.mode
-                    ?? scopes[PROJECT_SCOPE_KEY]?.mode
-                    ?? "observe";
-                let changed = current?.mode !== projectMode || current?.projectUrl !== projectUrl;
-                for (const [key, entry] of Object.entries(updates)) {
-                    const refreshed = { mode: entry.mode, fetchedAt: now };
-                    if (scopes[key]?.mode === refreshed.mode && scopes[key]?.fetchedAt === refreshed.fetchedAt)
-                        continue;
-                    scopes[key] = refreshed;
-                    changed = true;
-                }
-                if (!changed)
-                    return undefined;
-                const boundedScopes = Object.fromEntries(Object.entries(scopes)
-                    .sort(([, left], [, right]) => right.fetchedAt - left.fetchedAt)
-                    .slice(0, 256));
-                return {
-                    ...config,
-                    permissionModeCache: { mode: projectMode, fetchedAt: now, projectUrl, scopes: boundedScopes },
-                };
-            });
-        }
-        catch {
-            // Best-effort — a write failure just means the next process re-reads
-            // from the server (or starts at observe until it can).
-        }
+        persistPermissionModeMemo(client, projectUrl, now, requestedKeys);
     }
     return resolved;
 }

package/dist/permissions.js

@@ -220,6 +220,9 @@ async function gateToolCall(client, args) {
     // every read 401s: `session_inactive` denies every tool under `enforce`, and
     // under `observe` stops checking anything at all (#242).
     await (0, read_credential_js_1.ensureReadCredential)(client, { harness: args.harness });
+    if (!(args.shellCommand && (0, tool_catalog_js_1.isShellTool)(args.harness, args.toolName))) {
+        return batchNonShellGate(client, args);
+    }
     // Resolve the mode ONCE for this gate — a per-principal Keto permission read
     // (server → cache → observe), cached with a short TTL. Threaded downstream as
     // `modeOverride` so the whole gate (top-level check + every decomposed shell
@@ -240,16 +243,7 @@ async function gateToolCall(client, args) {
     // than before it, so the extra read costs no serial latency, and let a block
     // override an allow afterwards.
     const [decision, blocked] = await Promise.all([
-        args.shellCommand && (0, tool_catalog_js_1.isShellTool)(args.harness, args.toolName)
-            ? // Shell tools (issue #76): decompose the command into per-word sub-checks
-                // in addition to the top-level tool check. Only when the harness marks
-                // this a shell tool AND the raw command was threaded through — otherwise
-                // fall back to the plain single check (never breaks).
-                decomposeAndCheck(client, { ...args, modeOverride: mode })
-            : checkAndDecide(client, args.check, {
-                activityAttributes: args.activityAttributes,
-                modeOverride: mode,
-            }),
+        decomposeAndCheck(client, { ...args, modeOverride: mode }),
         findBlockedPrincipal(client, {
             namespace: args.check.namespace,
             object: args.check.object,
@@ -273,6 +267,77 @@ async function gateToolCall(client, args) {
     }
     return applyPrincipalBlock(client, { args, mode, decision, blocked });
 }
+async function batchNonShellGate(client, args) {
+    const additionalSubjects = [
+        { scope: "agent", subject: (0, subject_js_1.resolveAgentSubject)(client) },
+        { scope: "subagent", subject: (0, subject_js_1.resolveSubAgentSubject)(args.principals?.subAgentClientId) },
+    ].filter((item) => item.subject !== undefined);
+    const modeSubject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
+    const modePlan = args.modeOverride ? undefined : (0, permission_mode_js_1.preparePermissionModeBatch)(client, modeSubject, { additionalSubjects });
+    const candidates = principalBlockCandidates(client, args.principals);
+    const effectiveCheck = { ...args.check, relation: resolveCheckRelation(args.check.relation) };
+    const checks = [
+        ...(modePlan?.checks ?? []),
+        effectiveCheck,
+        ...candidates.map(({ ref }) => ({
+            namespace: args.check.namespace,
+            object: args.check.object,
+            relation: opl_js_1.RELATION_BLOCKED_SUBJECTS,
+            ...ref,
+        })),
+    ];
+    try {
+        const batch = await client.batchCheckPermissions(checks, {
+            activityAttributes: { ...args.activityAttributes, source: "tool_gate" },
+        });
+        const modeCount = modePlan?.checks.length ?? 0;
+        const mode = args.modeOverride ?? modePlan.resolve(batch.results.slice(0, modeCount)).mode;
+        const toolResult = batch.results[modeCount];
+        if (!toolResult || toolResult.error)
+            throw new Error(toolResult?.error ?? "missing tool result");
+        const result = { allowed: toolResult.allowed, checkedAt: batch.checkedAt, check: args.check };
+        const decision = await decidePermissionResult(client, result, effectiveCheck, {
+            activityAttributes: args.activityAttributes,
+            modeOverride: mode,
+        });
+        let blocked;
+        for (const [index, candidate] of candidates.entries()) {
+            const block = batch.results[modeCount + 1 + index];
+            if (block?.allowed && !block.error) {
+                blocked = {
+                    subject: candidate.level === "project" ? "project" : (0, subject_js_1.subjectLabel)(candidate.ref),
+                    level: candidate.level,
+                };
+                break;
+            }
+        }
+        return applyBlockedDecision(client, args, mode, decision, blocked);
+    }
+    catch {
+        const mode = args.modeOverride ?? (await (0, permission_mode_js_1.warmPermissionModeCache)(client, modeSubject, { additionalSubjects })).mode;
+        const [decision, blocked] = await Promise.all([
+            checkAndDecide(client, args.check, { activityAttributes: args.activityAttributes, modeOverride: mode }),
+            findBlockedPrincipal(client, { namespace: args.check.namespace, object: args.check.object, principals: args.principals }),
+        ]);
+        return applyBlockedDecision(client, args, mode, decision, blocked);
+    }
+}
+function applyBlockedDecision(client, args, mode, decision, blocked) {
+    if (!blocked)
+        return decision;
+    if (decision.kind === "deny") {
+        return {
+            ...decision,
+            activityAttributes: {
+                ...decision.activityAttributes,
+                blockReason: "explicit_block",
+                blockedPrincipal: blocked.subject,
+                blockedPrincipalLevel: blocked.level,
+            },
+        };
+    }
+    return applyPrincipalBlock(client, { args, mode, decision, blocked });
+}
 /**
  * Turn a machine-principal block into the gate's outcome, respecting
  * `permissionMode` exactly as any other deny does: `enforce` blocks, `observe`
@@ -610,6 +675,10 @@ async function checkAndDecide(client, check, opts = {}) {
     // Report the decision against the caller's original check (relation `use`),
     // not the internal permit rewrite, so callers see the coordinates they passed.
     result = { ...result, check };
+    return decidePermissionResult(client, result, effectiveCheck, opts);
+}
+async function decidePermissionResult(client, result, effectiveCheck, opts) {
+    const check = result.check;
     // A deny from the native `use` permit is necessarily an explicit block.
     // Retain the diagnostic probe only for other grant-based public checks.
     const blockReason = result.allowed
@@ -640,6 +709,24 @@ const PROJECT_BLOCK_SUBJECT = {
         relation: opl_js_1.RELATION_ENFORCED_SUBJECTS,
     },
 };
+function principalBlockCandidates(client, principals) {
+    const p = principals ?? {};
+    return [
+        { level: "project", ref: PROJECT_BLOCK_SUBJECT },
+        { level: "agent", ref: (0, subject_js_1.resolveAgentSubject)(client) },
+        { level: "agent_session", ref: (0, subject_js_1.resolveAgentSessionSubject)(client, p.sessionId) },
+        { level: "subagent", ref: (0, subject_js_1.resolveSubAgentSubject)(p.subAgentClientId) },
+        {
+            level: "subagent_spawn",
+            ref: p.subAgentType ? (0, subject_js_1.resolveSubAgentSpawnSubject)(client, {
+                subAgentClientId: p.subAgentClientId,
+                subAgentType: p.subAgentType,
+                perSpawnId: p.perSpawnId,
+                sessionId: p.sessionId,
+            }) : undefined,
+        },
+    ].filter((candidate) => candidate.ref !== undefined);
+}
 /**
  * Check whether the project or any acting machine principal is explicitly blocked from this
  * tool, and name the one that is.

package/dist/testing.d.ts

@@ -241,13 +241,21 @@ export declare function stubOAuth2Inactive(client: OryAgentClient): import("vite
  */
 export declare function setTestPermissionMode(mode: PermissionMode): void;
 /** Stub checkPermission to allow. */
-export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
-export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionDenied(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to throw a network error. */
-export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionNetworkError(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub checkPermission to throw a rate-limit error. */
-export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+export declare function stubPermissionRateLimited(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable> & {
+    batch: import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
+};
 /** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */
 export declare function stubMcpAllowed(client: OryAgentClient): import("vitest").Mock<import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Procedure | import(".pnpm/@vitest+spy@4.1.7/node_modules/@vitest/spy", { with: { "resolution-mode": "import" } }).Constructable>;
 /** Stub checkPermission to deny (server-only MCP check). */

package/dist/testing.js

@@ -454,7 +454,7 @@ function ensurePermissionCredential(client) {
 /** Stub checkPermission to allow. */
 function stubPermissionAllowed(client) {
     ensurePermissionCredential(client);
-    stubApi(client, "permission", "batchCheckPermission", (request) => {
+    const batch = stubApi(client, "permission", "batchCheckPermission", (request) => {
         const tuples = request.batchCheckPermissionBody?.tuples ?? [];
         return Promise.resolve({
             data: {
@@ -466,22 +466,38 @@ function stubPermissionAllowed(client) {
             },
         });
     });
-    return stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
+    const check = stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_ALLOWED));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to deny (the tool check; the mode check still answers `currentTestMode`). */
 function stubPermissionDenied(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_DENIED));
+    const batch = stubApi(client, "permission", "batchCheckPermission", (request) => {
+        const tuples = request.batchCheckPermissionBody?.tuples ?? [];
+        return Promise.resolve({
+            data: {
+                results: tuples.map((tuple) => ({
+                    allowed: tuple.relation === "enforcedSubjects" && currentTestMode === "enforce",
+                })),
+            },
+        });
+    });
+    const check = stubApi(client, "permission", "checkPermission", checkPermissionResponder(exports.PERMISSION_DENIED));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to throw a network error. */
 function stubPermissionNetworkError(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", () => Promise.reject(makeNetworkError()));
+    const batch = stubApi(client, "permission", "batchCheckPermission", () => Promise.reject(makeNetworkError()));
+    const check = stubApi(client, "permission", "checkPermission", () => Promise.reject(makeNetworkError()));
+    return Object.assign(check, { batch });
 }
 /** Stub checkPermission to throw a rate-limit error. */
 function stubPermissionRateLimited(client) {
     ensurePermissionCredential(client);
-    return stubApi(client, "permission", "checkPermission", () => Promise.reject(makeRateLimitError()));
+    const batch = stubApi(client, "permission", "batchCheckPermission", () => Promise.reject(makeRateLimitError()));
+    const check = stubApi(client, "permission", "checkPermission", () => Promise.reject(makeRateLimitError()));
+    return Object.assign(check, { batch });
 }
 // ─── MCP Stub Presets ─────────────────────────────────────────────
 /** Stub both checkPermission (server allow) and batchCheckPermission (both allow). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",