@ory/argus 1.2.4 → 1.3.0

package/dist/index.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.resetPermissionModeCache = exports.warmPermissionModeCache = exports.resolvePermissionMode = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.unregisterInstalledHarness = exports.registerInstalledHarness = exports.listInstalledHarnesses = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.describeSecurityGap = exports.isSecurityConnected = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.clearSessionContext = exports.setSessionContext = exports.withSessionContext = exports.currentSessionContext = exports.projectActivityEntry = exports.SERVER_ACTIVITY_EVENTS = exports.AgentSecurityEventReporter = exports.withQuietStderr = exports.formatLogEntry = exports.redactLogData = exports.ActiveActivity = exports.DebugLogger = exports.talosRuntimeCredential = exports.runCredentialStoreCommand = exports.resolveRuntimeCredential = exports.enrollTalosRuntimeCredential = exports.enrollTalosChildRuntimeCredential = exports.createOsTalosCredentialStore = exports.configureSystemCaTrustForDefaultFetch = exports.credentialAccount = exports.canonicalProjectUrl = exports.canonicalCredentialIdentity = exports.authenticatedRuntimeRequest = exports.OryAgentClient = void 0;
-exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = void 0;
-exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = void 0;
-exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = void 0;
-exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = void 0;
-exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = void 0;
+exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.resetPermissionModeCache = exports.warmPermissionModeCache = exports.resolvePermissionMode = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.unregisterInstalledHarness = exports.registerInstalledHarness = exports.listInstalledHarnesses = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfigAsync = exports.mutateConfig = exports.AGENT_ROOT_DELEGATION_ENV_VAR = exports.validateAgentRootDelegation = exports.readAgentRootDelegation = exports.describeSecurityGap = exports.isSecurityConnected = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.clearSessionContext = exports.setSessionContext = exports.withSessionContext = exports.currentSessionContext = exports.projectActivityEntry = exports.SERVER_ACTIVITY_EVENTS = exports.AgentSecurityEventReporter = exports.withQuietStderr = exports.formatLogEntry = exports.redactLogData = exports.ActiveActivity = exports.DebugLogger = exports.talosRuntimeCredential = exports.runCredentialStoreCommand = exports.resolveRuntimeCredential = exports.enrollTalosRuntimeCredential = exports.enrollTalosChildRuntimeCredential = exports.createOsTalosCredentialStore = exports.createSpiffeFileRequestAuthenticator = exports.configureSystemCaTrustForDefaultFetch = exports.credentialAccount = exports.canonicalProjectUrl = exports.canonicalCredentialIdentity = exports.authenticatedRuntimeRequest = exports.OryAgentClient = void 0;
+exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolvePreprovisionedRuntimeContext = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = void 0;
+exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.resolvePreprovisionedRootDelegation = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = void 0;
+exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = void 0;
+exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = void 0;
+exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var runtime_credential_js_1 = require("./runtime-credential.js");
@@ -14,6 +14,7 @@ Object.defineProperty(exports, "canonicalCredentialIdentity", { enumerable: true
 Object.defineProperty(exports, "canonicalProjectUrl", { enumerable: true, get: function () { return runtime_credential_js_1.canonicalProjectUrl; } });
 Object.defineProperty(exports, "credentialAccount", { enumerable: true, get: function () { return runtime_credential_js_1.credentialAccount; } });
 Object.defineProperty(exports, "configureSystemCaTrustForDefaultFetch", { enumerable: true, get: function () { return runtime_credential_js_1.configureSystemCaTrustForDefaultFetch; } });
+Object.defineProperty(exports, "createSpiffeFileRequestAuthenticator", { enumerable: true, get: function () { return runtime_credential_js_1.createSpiffeFileRequestAuthenticator; } });
 Object.defineProperty(exports, "createOsTalosCredentialStore", { enumerable: true, get: function () { return runtime_credential_js_1.createOsTalosCredentialStore; } });
 Object.defineProperty(exports, "enrollTalosChildRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosChildRuntimeCredential; } });
 Object.defineProperty(exports, "enrollTalosRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosRuntimeCredential; } });
@@ -41,7 +42,11 @@ Object.defineProperty(exports, "saveConfig", { enumerable: true, get: function (
 Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_js_1.resolveConfig; } });
 Object.defineProperty(exports, "isSecurityConnected", { enumerable: true, get: function () { return config_js_1.isSecurityConnected; } });
 Object.defineProperty(exports, "describeSecurityGap", { enumerable: true, get: function () { return config_js_1.describeSecurityGap; } });
+Object.defineProperty(exports, "readAgentRootDelegation", { enumerable: true, get: function () { return config_js_1.readAgentRootDelegation; } });
+Object.defineProperty(exports, "validateAgentRootDelegation", { enumerable: true, get: function () { return config_js_1.validateAgentRootDelegation; } });
+Object.defineProperty(exports, "AGENT_ROOT_DELEGATION_ENV_VAR", { enumerable: true, get: function () { return config_js_1.AGENT_ROOT_DELEGATION_ENV_VAR; } });
 Object.defineProperty(exports, "mutateConfig", { enumerable: true, get: function () { return config_js_1.mutateConfig; } });
+Object.defineProperty(exports, "mutateConfigAsync", { enumerable: true, get: function () { return config_js_1.mutateConfigAsync; } });
 Object.defineProperty(exports, "getConfigPath", { enumerable: true, get: function () { return config_js_1.getConfigPath; } });
 Object.defineProperty(exports, "getDataDir", { enumerable: true, get: function () { return config_js_1.getDataDir; } });
 Object.defineProperty(exports, "getHarnessDataDir", { enumerable: true, get: function () { return config_js_1.getHarnessDataDir; } });
@@ -96,6 +101,7 @@ Object.defineProperty(exports, "ensureUserAuthenticated", { enumerable: true, ge
 Object.defineProperty(exports, "ensureAuthenticated", { enumerable: true, get: function () { return user_login_js_1.ensureAuthenticated; } });
 var agent_auth_js_1 = require("./agent-auth.js");
 Object.defineProperty(exports, "resolveAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveAgentCredentials; } });
+Object.defineProperty(exports, "resolvePreprovisionedRuntimeContext", { enumerable: true, get: function () { return agent_auth_js_1.resolvePreprovisionedRuntimeContext; } });
 Object.defineProperty(exports, "resolveRuntimeAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveRuntimeAgentCredentials; } });
 Object.defineProperty(exports, "ensureAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureAgentIdentity; } });
 Object.defineProperty(exports, "ensureSubAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureSubAgentIdentity; } });
@@ -117,6 +123,7 @@ Object.defineProperty(exports, "clearSubAgentDynamicCredentials", { enumerable:
 Object.defineProperty(exports, "clearSubAgentDynamicCredentialsForHarness", { enumerable: true, get: function () { return agent_auth_js_1.clearSubAgentDynamicCredentialsForHarness; } });
 Object.defineProperty(exports, "claimSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.claimSubAgentDynamicCredentials; } });
 Object.defineProperty(exports, "loadDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.loadDelegationNodeId; } });
+Object.defineProperty(exports, "resolvePreprovisionedRootDelegation", { enumerable: true, get: function () { return agent_auth_js_1.resolvePreprovisionedRootDelegation; } });
 Object.defineProperty(exports, "saveDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.saveDelegationNodeId; } });
 Object.defineProperty(exports, "loadRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadRetiredCredentials; } });
 Object.defineProperty(exports, "clearRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.clearRetiredCredentials; } });

package/dist/lifecycle.js

@@ -160,7 +160,8 @@ exports.HARNESS_LIFECYCLE_MAP = {
     },
     // Cursor (editor + CLI). Subprocess hooks read from `.cursor/hooks.json`.
     // `preToolUse` is the single permission gate — it already fires for every
-    // tool category (Shell, Read, Write, MCP, Task). The more specific
+    // documented tool category (Shell, Read, Write, Grep, Delete, Task) and
+    // dynamic MCP calls. The more specific
     // `beforeShellExecution` / `beforeMCPExecution` / `beforeReadFile` hooks and
     // their `after*` counterparts surface activity to the user and are
     // activity-only (`user.interaction`), so shell/MCP/file access isn't gated

package/dist/local/configs.d.ts

@@ -76,10 +76,8 @@ export interface OathkeeperConfig {
  * contract: an Oathkeeper service configured like the hosted
  * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
  * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
- * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
- * read permissions locally, exactly as it is on a hosted Ory project. (The
- * plugin's agent DCR / user PKCE tokens are populated before any permission read
- * runs, so this is transparent in the normal flow.)
+ * upstream to keto-read — so a valid OAuth2 access token is *required* to use
+ * this direct local read path, exactly as it is on a hosted Ory project.
  *
  * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
  * to a transparent nginx passthrough that strips `/user` and forwards straight to

package/dist/local/configs.js

@@ -201,10 +201,8 @@ function getConsoleConfig(projectRoot) {
  * contract: an Oathkeeper service configured like the hosted
  * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
  * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
- * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
- * read permissions locally, exactly as it is on a hosted Ory project. (The
- * plugin's agent DCR / user PKCE tokens are populated before any permission read
- * runs, so this is transparent in the normal flow.)
+ * upstream to keto-read — so a valid OAuth2 access token is *required* to use
+ * this direct local read path, exactly as it is on a hosted Ory project.
  *
  * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
  * to a transparent nginx passthrough that strips `/user` and forwards straight to

package/dist/local/manager.js

@@ -843,7 +843,7 @@ function printSeedResult(result) {
     console.log("Seed complete!");
     console.log("==============");
     console.log("");
-    console.log(`  Agent identity: self-registers on first run via DCR (nothing seeded)`);
+    console.log(`  Agent identity: Talos enrollment runs at session start (nothing seeded)`);
     console.log("");
     console.log(`  User identity:  ${result.user.identity.email} (${result.user.identity.id})`);
     console.log(`  User password:  ${result.user.password}`);
@@ -860,9 +860,9 @@ function printSeedResult(result) {
     console.log(`  export ORY_USER_SUBJECT_ID=${result.user.identity.id}`);
     console.log("");
     console.log("The user gate runs PKCE in the browser — sign in with the email and");
-    console.log("password printed above. The agent OAuth2 client is registered");
-    console.log("automatically via Dynamic Client Registration (RFC 7591) on first");
-    console.log("session using the user's bearer as the initial access token.");
+    console.log("password printed above. At first session start, the authenticated user");
+    console.log("enrolls an actor-bound Talos credential. It is stored in the native OS");
+    console.log("credential store; tool hooks only load the existing credential.");
     console.log("");
     console.log("Or save the project URL to the shared config (persists across sessions):");
     console.log("");

package/dist/local/seed.d.ts

@@ -7,10 +7,10 @@
  * redirect URIs. The launcher always runs the real PKCE browser flow; the
  * user types these credentials into the login UI to complete the flow.
  *
- * No agent principal is seeded: the harness self-registers a DCR OAuth2
- * client for the agent on first session start (using the user's bearer as
- * the initial access token), and permission checks are made against the
- * user subject — so a pre-seeded agent Kratos identity would be unused.
+ * No agent principal is seeded: Agent Security enrolls a Talos runtime
+ * credential at session start using the authenticated user's bearer, and
+ * permission checks are made against the user subject. A pre-seeded agent
+ * Kratos identity would be unused.
  *
  * Permission tuples are written as SubjectSet `User:<identity.id>` so
  * the Console's *Add relationship* dialog (which always emits SubjectSet

package/dist/local/seed.js

@@ -8,10 +8,10 @@
  * redirect URIs. The launcher always runs the real PKCE browser flow; the
  * user types these credentials into the login UI to complete the flow.
  *
- * No agent principal is seeded: the harness self-registers a DCR OAuth2
- * client for the agent on first session start (using the user's bearer as
- * the initial access token), and permission checks are made against the
- * user subject — so a pre-seeded agent Kratos identity would be unused.
+ * No agent principal is seeded: Agent Security enrolls a Talos runtime
+ * credential at session start using the authenticated user's bearer, and
+ * permission checks are made against the user subject. A pre-seeded agent
+ * Kratos identity would be unused.
  *
  * Permission tuples are written as SubjectSet `User:<identity.id>` so
  * the Console's *Add relationship* dialog (which always emits SubjectSet
@@ -157,9 +157,8 @@ async function seedLocalEnvironment(namespace = "AgentTool") {
         throw new Error(`backend services not ready before seed: ${readiness.pending.join(", ")} ` +
             `did not report ready within the timeout. The stack may still be starting — retry in a moment.`);
     }
-    // 1. User identity. No agent identity is seeded — the harness
-    //    self-registers a DCR OAuth2 client for the agent on first session
-    //    start, and permission checks target the user subject.
+    // 1. User identity. No agent identity is seeded; Talos enrollment is owned
+    //    by Agent Security at session start, and checks target the user subject.
     process.stderr.write("  Creating user identity...\n");
     const userIdentity = await seedIdentity(USER_EMAIL, USER_PASSWORD, "Local User");
     process.stderr.write(`  User: ${userIdentity.id} (${userIdentity.email})\n`);
@@ -168,9 +167,8 @@ async function seedLocalEnvironment(namespace = "AgentTool") {
     const subjectLabel = `${exports.USER_SUBJECT_NAMESPACE}:${userIdentity.id}`;
     process.stderr.write("  Native tools: allowed unless explicitly blocked (no baseline grants)\n");
     // 3. User OAuth2 client (PKCE) — pre-registered so the user gate's
-    //    PKCE flow has somewhere to authenticate against. The agent's
-    //    OAuth2 client is intentionally NOT pre-registered; the harness
-    //    will self-register via DCR on first session start.
+    //    PKCE flow has somewhere to authenticate against. Agent identity uses
+    //    Talos runtime enrollment, so no agent OAuth2 client is seeded.
     process.stderr.write("  Registering user OAuth2 client (PKCE)...\n");
     let userClient = { clientId: exports.USER_CLIENT_ID };
     try {

package/dist/runtime-credential.d.ts

@@ -1,3 +1,5 @@
+import { readFile, realpath } from "node:fs/promises";
+import * as nodeHttps from "node:https";
 /** The broker header a runtime credential must occupy for a request. */
 export type RuntimeAuthorizationHeader = "authorization" | "x-ory-agent-authorization";
 export interface RuntimeAuthenticatedRequest {
@@ -15,10 +17,37 @@ export interface RuntimeAuthenticatedRequest {
  * the request over mTLS without exposing key material to Argus.
  */
 export type RuntimeRequestAuthenticator = (request: RuntimeAuthenticatedRequest) => Promise<Response>;
+export interface SpiffeFileRequestAuthenticatorOptions {
+    /** Atomically switched directory or symlink containing one material generation. */
+    generationPath?: string;
+    certificatePath?: string;
+    privateKeyPath?: string;
+    trustBundlePath?: string;
+    certificateFile?: string;
+    privateKeyFile?: string;
+    trustBundleFile?: string;
+    /** Optional marker read before and after the PEM files to reject mixed generations. */
+    generationFile?: string;
+    /** Exact URI SAN required on the peer leaf certificate. */
+    expectedServerSpiffeId?: string;
+    /** Exact and sole URI SAN required on the loaded client leaf certificate. */
+    expectedClientSpiffeId?: string;
+    /** Explicitly use ordinary HTTPS hostname verification instead of SPIFFE identity. */
+    verifyHostname?: boolean;
+    privateKeyPassphrase?: string;
+    /** @internal Injectable seam for focused transport tests. */
+    readFile?: typeof readFile;
+    /** @internal Injectable seam for focused generation-path tests. */
+    realpath?: typeof realpath;
+    /** @internal Injectable seam for focused transport tests. */
+    request?: typeof nodeHttps.request;
+}
 export type RuntimeCredentialKind = "talos" | "injected";
 export interface RuntimeCredential {
     kind: RuntimeCredentialKind;
     subject?: string;
+    /** @internal Non-secret binding used to recognize the same Talos key after re-resolution. */
+    apiKeyFingerprint?: string;
     authenticate: RuntimeRequestAuthenticator;
 }
 export interface ResolveRuntimeCredentialOptions {
@@ -115,6 +144,12 @@ export declare function talosRuntimeCredential(apiKey: string, options?: {
     /** @internal Injectable seam for testing default-fetch TLS setup. */
     configureSystemCaTrust?: () => void;
 }): RuntimeCredential;
+/**
+ * Build an mTLS authenticator from operator-managed SPIFFE files. The files are
+ * re-read for every request so atomic SVID and trust-bundle rotations are used
+ * without restarting the process.
+ */
+export declare function createSpiffeFileRequestAuthenticator(options: SpiffeFileRequestAuthenticatorOptions): RuntimeRequestAuthenticator;
 /** Resolve only noninteractive runtime credentials. No persisted state is read. */
 export declare function resolveRuntimeCredential(options?: ResolveRuntimeCredentialOptions): RuntimeCredential | undefined;
 /** Explicitly enroll a Talos credential and optionally persist it in an OS store. */

package/dist/runtime-credential.js

@@ -40,13 +40,18 @@ exports.canonicalCredentialIdentity = canonicalCredentialIdentity;
 exports.credentialAccount = credentialAccount;
 exports.createOsTalosCredentialStore = createOsTalosCredentialStore;
 exports.talosRuntimeCredential = talosRuntimeCredential;
+exports.createSpiffeFileRequestAuthenticator = createSpiffeFileRequestAuthenticator;
 exports.resolveRuntimeCredential = resolveRuntimeCredential;
 exports.enrollTalosRuntimeCredential = enrollTalosRuntimeCredential;
 exports.enrollTalosChildRuntimeCredential = enrollTalosChildRuntimeCredential;
 exports.authenticatedRuntimeRequest = authenticatedRuntimeRequest;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const nodeHttps = __importStar(require("node:https"));
+const node_path_1 = require("node:path");
 const nodeTls = __importStar(require("node:tls"));
+const SPIFFE_CREDENTIAL_METHOD = "spiffe_x509_svid";
 const CREDENTIAL_SERVICE = "com.ory.agent-security.runtime-credential";
 const MACOS_CREDENTIAL_SCRIPT = String.raw `
 ObjC.import('Foundation');
@@ -407,6 +412,7 @@ function talosRuntimeCredential(apiKey, options = {}) {
     return {
         kind: "talos",
         ...(options.subject ? { subject: options.subject } : {}),
+        apiKeyFingerprint: (0, node_crypto_1.createHash)("sha256").update(key).digest("hex"),
         authenticate: async ({ url, init, authorizationHeader, fetch: requestFetch, usesDefaultFetch, }) => {
             const headerName = authorizationHeader === "authorization"
                 ? "authorization"
@@ -430,6 +436,205 @@ function talosRuntimeCredential(apiKey, options = {}) {
         },
     };
 }
+/**
+ * Build an mTLS authenticator from operator-managed SPIFFE files. The files are
+ * re-read for every request so atomic SVID and trust-bundle rotations are used
+ * without restarting the process.
+ */
+function createSpiffeFileRequestAuthenticator(options) {
+    const read = options.readFile ?? promises_1.readFile;
+    const resolveRealpath = options.realpath ?? promises_1.realpath;
+    const requestHttps = options.request ?? nodeHttps.request;
+    const expectedServerSpiffeId = options.expectedServerSpiffeId
+        ? canonicalSpiffeId(options.expectedServerSpiffeId)
+        : undefined;
+    const expectedClientSpiffeId = options.expectedClientSpiffeId
+        ? canonicalSpiffeId(options.expectedClientSpiffeId, "expectedClientSpiffeId")
+        : undefined;
+    if (Boolean(expectedServerSpiffeId) === Boolean(options.verifyHostname)) {
+        throw new Error("SPIFFE file authentication requires exactly one of expectedServerSpiffeId or verifyHostname");
+    }
+    const materialPaths = async () => {
+        if (options.generationPath) {
+            const generation = await resolveRealpath(options.generationPath);
+            const files = [
+                options.certificateFile ?? "svid.pem",
+                options.privateKeyFile ?? "svid-key.pem",
+                options.trustBundleFile ?? "bundle.pem",
+                options.generationFile,
+            ];
+            const paths = files.map((file) => {
+                if (file === undefined)
+                    return undefined;
+                if ((0, node_path_1.isAbsolute)(file)) {
+                    throw new Error("SPIFFE generation file names must be relative paths");
+                }
+                const path = (0, node_path_1.resolve)(generation, file);
+                const fromGeneration = (0, node_path_1.relative)(generation, path);
+                if (fromGeneration === ".." || fromGeneration.startsWith(`..${node_path_1.sep}`)) {
+                    throw new Error("SPIFFE generation file names must remain within the generation path");
+                }
+                return path;
+            });
+            return paths;
+        }
+        if (options.generationFile) {
+            throw new Error("SPIFFE generationFile requires generationPath");
+        }
+        if (!options.certificatePath || !options.privateKeyPath || !options.trustBundlePath) {
+            throw new Error("SPIFFE file authentication requires generationPath or all three material paths");
+        }
+        return [options.certificatePath, options.privateKeyPath, options.trustBundlePath];
+    };
+    const isKeyMismatch = (error) => {
+        if (!(error instanceof Error))
+            return false;
+        const code = error.code;
+        return code === "ERR_OSSL_X509_KEY_VALUES_MISMATCH"
+            || /key values mismatch/i.test(error.message);
+    };
+    return async ({ url, init }) => {
+        const target = new URL(url);
+        if (target.protocol !== "https:") {
+            throw new Error("SPIFFE file authentication requires an HTTPS URL");
+        }
+        if (target.username || target.password) {
+            throw new Error("SPIFFE file authentication does not accept URL credentials");
+        }
+        const normalized = new Request(target, init);
+        const body = normalized.body === null
+            ? undefined
+            : Buffer.from(await normalized.arrayBuffer());
+        const send = async () => {
+            let snapshot;
+            for (let attempt = 0; attempt < 2; attempt += 1) {
+                const [certificatePath, privateKeyPath, trustBundlePath, generationFile] = await materialPaths();
+                const generationBefore = generationFile ? await read(generationFile) : undefined;
+                const [cert, key, ca] = await Promise.all([
+                    read(certificatePath),
+                    read(privateKeyPath),
+                    read(trustBundlePath),
+                ]);
+                const generationAfter = generationFile ? await read(generationFile) : undefined;
+                if (!generationBefore || (generationAfter && generationBefore.equals(generationAfter))) {
+                    if (expectedClientSpiffeId) {
+                        validateClientCertificate(cert, expectedClientSpiffeId);
+                    }
+                    snapshot = [cert, key, ca];
+                    break;
+                }
+            }
+            if (!snapshot)
+                throw new Error("SPIFFE material generation changed while loading files");
+            const [cert, key, ca] = snapshot;
+            return await new Promise((resolveResponse, reject) => {
+                const outgoing = requestHttps(target, {
+                    method: normalized.method,
+                    headers: Object.fromEntries(normalized.headers),
+                    cert,
+                    key,
+                    ...(expectedServerSpiffeId ? { ca } : {}),
+                    ...(options.privateKeyPassphrase ? { passphrase: options.privateKeyPassphrase } : {}),
+                    minVersion: "TLSv1.3",
+                    rejectUnauthorized: true,
+                    ...(expectedServerSpiffeId ? {
+                        // Never reuse a connection authenticated under another expected workload ID.
+                        agent: false,
+                        checkServerIdentity: (_hostname, certificate) => {
+                            if (!peerHasExactUriSan(certificate.subjectaltname, expectedServerSpiffeId)) {
+                                return new Error(`Peer certificate does not contain expected SPIFFE URI SAN ${expectedServerSpiffeId}`);
+                            }
+                            return undefined;
+                        },
+                    } : {}),
+                    signal: init.signal ?? undefined,
+                }, (incoming) => {
+                    const chunks = [];
+                    incoming.on("data", (chunk) => {
+                        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                    });
+                    incoming.on("end", () => {
+                        const headers = new Headers();
+                        for (let index = 0; index < incoming.rawHeaders.length; index += 2) {
+                            headers.append(incoming.rawHeaders[index], incoming.rawHeaders[index + 1]);
+                        }
+                        resolveResponse(new Response(Buffer.concat(chunks), {
+                            status: incoming.statusCode ?? 500,
+                            statusText: incoming.statusMessage,
+                            headers,
+                        }));
+                    });
+                    incoming.on("error", reject);
+                });
+                outgoing.on("error", reject);
+                if (body)
+                    outgoing.write(body);
+                outgoing.end();
+            });
+        };
+        try {
+            return await send();
+        }
+        catch (error) {
+            if (!isKeyMismatch(error))
+                throw error;
+            return await send();
+        }
+    };
+}
+function canonicalSpiffeId(value, name = "expectedServerSpiffeId") {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "spiffe:"
+        || !parsed.hostname
+        || parsed.username
+        || parsed.password
+        || parsed.port
+        || parsed.search
+        || parsed.hash) {
+        throw new Error(`${name} must be a valid SPIFFE ID`);
+    }
+    return value;
+}
+function validateClientCertificate(certificate, expectedSpiffeId) {
+    let leaf;
+    try {
+        leaf = new node_crypto_1.X509Certificate(certificate);
+    }
+    catch {
+        throw new Error("SPIFFE client certificate is not a valid X.509 certificate");
+    }
+    const uriSans = uriSansFromSubjectAltName(leaf.subjectAltName);
+    if (uriSans.length !== 1 || uriSans[0] !== expectedSpiffeId) {
+        throw new Error(`Client certificate must contain only the expected SPIFFE URI SAN ${expectedSpiffeId}`);
+    }
+    const now = Date.now();
+    if (now < Date.parse(leaf.validFrom) || now > Date.parse(leaf.validTo)) {
+        throw new Error("SPIFFE client certificate is not currently valid");
+    }
+}
+function uriSansFromSubjectAltName(subjectAltName) {
+    if (!subjectAltName)
+        return [];
+    const result = [];
+    for (const entry of subjectAltName.match(/(?:^|, )URI:(?:"(?:\\.|[^"\\])*"|.*?)(?=, [A-Za-z0-9.]+:|$)/g) ?? []) {
+        const encoded = entry.replace(/^, /, "").slice(4);
+        if (!encoded.startsWith('"')) {
+            result.push(encoded);
+            continue;
+        }
+        try {
+            result.push(JSON.parse(encoded));
+        }
+        catch {
+            // Malformed SANs cannot satisfy an exact SPIFFE identity match.
+        }
+    }
+    return result;
+}
+function peerHasExactUriSan(subjectAltName, expected) {
+    const uriSans = uriSansFromSubjectAltName(subjectAltName);
+    return uriSans.length === 1 && uriSans[0] === expected;
+}
 /** Resolve only noninteractive runtime credentials. No persisted state is read. */
 function resolveRuntimeCredential(options = {}) {
     if (options.requestAuthenticator) {
@@ -439,11 +644,57 @@ function resolveRuntimeCredential(options = {}) {
             authenticate: options.requestAuthenticator,
         };
     }
-    const apiKey = (options.env ?? process.env).ORY_AGENT_API_KEY?.trim();
+    const env = options.env ?? process.env;
+    if (env.ORY_AGENT_CREDENTIAL_METHOD?.trim() === SPIFFE_CREDENTIAL_METHOD) {
+        const expectedClientSpiffeId = requiredEnv(env, "ORY_AGENT_SPIFFE_ID");
+        const generationPath = env.ORY_AGENT_SPIFFE_GENERATION_PATH?.trim();
+        const certificatePath = env.ORY_AGENT_SPIFFE_SVID_PATH?.trim();
+        const privateKeyPath = env.ORY_AGENT_SPIFFE_KEY_PATH?.trim();
+        const trustBundlePath = env.ORY_AGENT_SPIFFE_TRUST_BUNDLE_PATH?.trim();
+        const generationFile = env.ORY_SPIFFE_GENERATION_FILE?.trim();
+        const directPaths = [certificatePath, privateKeyPath, trustBundlePath];
+        if (generationPath && directPaths.some(Boolean)) {
+            throw new Error("SPIFFE configuration must use either ORY_AGENT_SPIFFE_GENERATION_PATH or direct material paths");
+        }
+        if (!generationPath && !directPaths.every(Boolean)) {
+            throw new Error("SPIFFE configuration requires ORY_AGENT_SPIFFE_GENERATION_PATH or all three direct material paths");
+        }
+        if (!generationPath && generationFile) {
+            throw new Error("ORY_SPIFFE_GENERATION_FILE requires ORY_AGENT_SPIFFE_GENERATION_PATH");
+        }
+        const expectedServerSpiffeId = env.ORY_AGENT_SPIFFE_SERVER_ID?.trim();
+        return {
+            kind: "injected",
+            ...(options.subject ? { subject: options.subject } : {}),
+            authenticate: createSpiffeFileRequestAuthenticator({
+                ...(generationPath ? {
+                    generationPath,
+                    ...(generationFile
+                        ? { generationFile }
+                        : {}),
+                } : {
+                    certificatePath: certificatePath,
+                    privateKeyPath: privateKeyPath,
+                    trustBundlePath: trustBundlePath,
+                }),
+                expectedClientSpiffeId,
+                ...(expectedServerSpiffeId
+                    ? { expectedServerSpiffeId }
+                    : { verifyHostname: true }),
+            }),
+        };
+    }
+    const apiKey = env.ORY_AGENT_API_KEY?.trim();
     if (!apiKey)
         return undefined;
     return talosRuntimeCredential(apiKey, { subject: options.subject, fetch: options.fetch });
 }
+function requiredEnv(env, name) {
+    const value = env[name]?.trim();
+    if (!value)
+        throw new Error(`SPIFFE configuration requires ${name}`);
+    return value;
+}
 /** Explicitly enroll a Talos credential and optionally persist it in an OS store. */
 async function enrollTalosRuntimeCredential(options) {
     let response;

package/dist/runtime.d.ts

@@ -26,10 +26,10 @@
  *      wired where, so `status` can report the runtime a harness will actually
  *      load, upgrades can rewire, and unreferenced stores can be pruned.
  *
- * A **linked** runtime (`linkedRuntime`) points the shim straight at a
- * workspace build instead of a materialized store. That is the development
- * loop: `pnpm build` + relaunch, with no publish, no version bump, and no
- * registry involved.
+ * A **linked** runtime (`linkedRuntime`) points the shim straight at an
+ * explicit prebuilt package directory instead of a materialized store. This
+ * supports both administrator-managed runtimes and the workspace development
+ * loop (`pnpm build` + relaunch), with no registry involved.
  *
  * ## The shim must fail open
  *
@@ -137,8 +137,8 @@ export declare function materializeRuntime(opts: {
     installer?: NpmInstaller;
 }): RuntimeTarget;
 /**
- * Use an already-built package directory as the runtime — the development
- * path (`install --link <dir>`), where the workspace build *is* the artifact.
+ * Use an explicit prebuilt package directory as the runtime, including a
+ * managed installation or workspace build.
  *
  * Validates that the directory looks like a built package so a typo surfaces
  * at install time instead of as hooks that silently never run.
@@ -206,13 +206,19 @@ export declare function writeMcpShim(opts: {
     target: RuntimeTarget;
     installCommand: string;
 }): string | undefined;
+/**
+ * Resolve the Node executable persisted in subprocess hook and MCP config.
+ * Managed installations can pin an administrator-approved absolute path;
+ * ordinary installations retain the portable `node` command lookup.
+ */
+export declare function resolvePluginNodePath(env?: NodeJS.ProcessEnv): string;
 /**
  * The hook command a harness config should carry: `node "<shim>"`.
  *
- * Quoted because a data dir can contain spaces, and several harnesses run the
- * command through a shell.
+ * Paths are shell-quoted because managed executables and data dirs can contain
+ * spaces or shell metacharacters, and several harnesses run this as a string.
  */
-export declare function hookCommand(shimPath: string): string;
+export declare function hookCommand(shimPath: string, nodePath?: string): string;
 /**
  * True when a command in a harness config is one of ours.
  *
@@ -225,7 +231,7 @@ export declare function hookCommand(shimPath: string): string;
  */
 export declare function isOryRuntimeCommand(command: string | undefined): boolean;
 /** The MCP server registration a harness config should carry. */
-export declare function mcpCommand(shimPath: string): {
+export declare function mcpCommand(shimPath: string, nodePath?: string): {
     command: string;
     args: string[];
 };
@@ -296,8 +302,9 @@ export declare function pruneRuntimeStores(): string[];
  *   `ORY_PLUGIN_RUNTIME_DIR`    → link that directory
  *   otherwise                   → materialize the CLI's own version
  *
- * The flag and the env var support explicit source installs that point at an
- * already-built workspace package instead of materializing from a registry.
+ * The flag and the env var support explicit prebuilt runtime installs,
+ * including administrator-managed package directories and workspace builds,
+ * instead of materializing from a registry.
  *
  * The flag deliberately requires an explicit directory. A bare "link whatever
  * package I am running from" would resolve to npx's ephemeral cache dir under