@ory/argus 0.1.0

package/dist/local/configs.js

@@ -0,0 +1,634 @@
+"use strict";
+/**
+ * Ory service configuration templates for local development.
+ *
+ * Each function returns the file content as a string. The local manager
+ * writes these into .ory-dev/ory/ at runtime so Docker Compose can mount them.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JAEGER_OTLP_HTTP_URL = exports.JAEGER_UI_URL = exports.JAEGER_OTLP_HTTP_PORT = exports.JAEGER_UI_PORT = exports.HYDRA_ADMIN_PORT = exports.HYDRA_PUBLIC_PORT = exports.KETO_WRITE_PORT = exports.KETO_READ_PORT = exports.KRATOS_ADMIN_PORT = exports.KRATOS_PUBLIC_PORT = exports.LOGIN_UI_URL = exports.LOGIN_UI_PORT = exports.CONSOLE_URL = exports.CONSOLE_PORT = exports.GATEWAY_URL = exports.GATEWAY_PORT = exports.DEFAULT_CONSOLE_LITE_SUBPATH = void 0;
+exports.getGatewayConfig = getGatewayConfig;
+exports.getConsoleConfig = getConsoleConfig;
+exports.dockerComposeYaml = dockerComposeYaml;
+exports.kratosConfigYaml = kratosConfigYaml;
+exports.kratosIdentitySchema = kratosIdentitySchema;
+exports.ketoConfigYaml = ketoConfigYaml;
+exports.hydraConfigYaml = hydraConfigYaml;
+exports.nginxConf = nginxConf;
+exports.gatewayHealthUrl = gatewayHealthUrl;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/** Default location of the Console Lite source tree, sibling-checkout layout. */
+exports.DEFAULT_CONSOLE_LITE_SUBPATH = path.join("..", "cloud", "console", "console");
+/**
+ * Console Lite listens on this container-internal port (Dockerfile sets
+ * `ENV PORT=3000`). Bound to the host on CONSOLE_PORT.
+ */
+const CONSOLE_LITE_INTERNAL_PORT = 3000;
+function defaultElementsPath(buildContext) {
+    // Dockerfile expects `--build-context elements=<elements-dir>`, located at
+    // `<console-lite>/../../elements` (i.e. sibling of console/ inside the
+    // cloud monorepo).
+    return path.resolve(buildContext, "..", "..", "elements");
+}
+function consoleLiteUsable(buildContext, dockerfile, elementsContext) {
+    try {
+        return (fs.existsSync(buildContext) &&
+            fs.existsSync(path.join(buildContext, dockerfile)) &&
+            fs.existsSync(elementsContext));
+    }
+    catch {
+        return false;
+    }
+}
+function consoleConfig(buildContext, dockerfile, elementsContext, buildMode, source) {
+    return {
+        enabled: true,
+        buildContext,
+        dockerfile,
+        elementsContext,
+        buildMode,
+        source,
+    };
+}
+/**
+ * Walk up from the given directory and return the outermost ancestor that
+ * contains a `.git` entry (file or directory). This anchors the default
+ * sibling-checkout layout to the main repo root even when called from a
+ * worktree (where `.git` is a file pointer at the leaf and a real directory
+ * further up). Returns the input dir when no `.git` ancestor exists.
+ */
+function findOutermostGitAncestor(startDir) {
+    let dir = startDir;
+    let outermost = null;
+    while (dir !== path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, ".git"))) {
+            outermost = dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return outermost ?? startDir;
+}
+/**
+ * Resolve a path that may be absolute or relative. Relative paths are
+ * resolved against pnpm's `INIT_CWD` (the user's terminal cwd when they
+ * invoked `pnpm <script>`) so an env var like
+ * `ORY_CONSOLE_LITE_PATH=../../../cloud/console/console` matches the
+ * user's shell intuition rather than the script's runtime cwd.
+ */
+function resolveUserPath(input) {
+    if (path.isAbsolute(input))
+        return input;
+    const anchor = process.env.INIT_CWD?.trim() || process.env.PWD?.trim() || process.cwd();
+    return path.resolve(anchor, input);
+}
+/**
+ * The API gateway is always the bundled nginx routing layer that
+ * proxies bare Ory paths to Kratos / Hydra / Keto. No mode choice.
+ */
+function getGatewayConfig() {
+    return { healthPath: "/health" };
+}
+/**
+ * Resolve whether the optional Console Lite UI service should be brought
+ * up, and if so, with what build inputs.
+ *
+ * Enabled when Console Lite source is present at
+ * `<repoRoot>/../cloud/console/console` (sibling checkout, where
+ * `repoRoot` is the outermost `.git` ancestor of the given `projectRoot`).
+ * Disabled when that path is missing or unreadable.
+ *
+ * `ORY_CONSOLE_LITE_PATH` is an explicit override. When set it must
+ * point at a usable build context; downstream validation surfaces a hard
+ * error if the path doesn't exist. Relative paths are resolved against
+ * pnpm's `INIT_CWD` so they match the user's shell cwd.
+ */
+function getConsoleConfig(projectRoot) {
+    const dockerfile = process.env.ORY_CONSOLE_LITE_DOCKERFILE?.trim() || "Dockerfile";
+    const elementsOverride = process.env.ORY_CONSOLE_LITE_ELEMENTS_PATH?.trim();
+    const buildMode = process.env.ORY_CONSOLE_LITE_BUILD_MODE?.trim() || "oss";
+    const explicit = process.env.ORY_CONSOLE_LITE_PATH?.trim();
+    if (explicit) {
+        const buildContext = resolveUserPath(explicit);
+        const elementsContext = elementsOverride
+            ? resolveUserPath(elementsOverride)
+            : defaultElementsPath(buildContext);
+        return consoleConfig(buildContext, dockerfile, elementsContext, buildMode, "env");
+    }
+    if (projectRoot) {
+        const repoRoot = findOutermostGitAncestor(projectRoot);
+        const def = path.resolve(repoRoot, exports.DEFAULT_CONSOLE_LITE_SUBPATH);
+        const elementsContext = elementsOverride
+            ? resolveUserPath(elementsOverride)
+            : defaultElementsPath(def);
+        if (consoleLiteUsable(def, dockerfile, elementsContext)) {
+            return consoleConfig(def, dockerfile, elementsContext, buildMode, "default");
+        }
+    }
+    return { enabled: false };
+}
+// ─── Docker Compose ────────────────────────────────────────────────
+function nginxGatewayService() {
+    return `  gateway:
+    image: nginx:alpine
+    container_name: gateway
+    mem_limit: 128m
+    cpus: "1.0"
+    ports:
+      - "${exports.GATEWAY_PORT}:${exports.GATEWAY_PORT}"
+    volumes:
+      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+    depends_on:
+      - kratos
+      - hydra
+      - keto
+    networks:
+      - ory-local
+`;
+}
+/**
+ * `oryd/kratos-selfservice-ui-node` runs the login + consent UI that
+ * Hydra redirects users to during the OAuth2 authorize flow. When
+ * `HYDRA_ADMIN_URL` is set it also handles the consent challenge
+ * (auto-approves for dev). It's reachable from the host on LOGIN_UI_PORT
+ * because the user's browser is redirected here.
+ *
+ * `COOKIE_SECRET` and `CSRF_COOKIE_SECRET` are required by the image —
+ * the container exits at startup if they're missing. Both must be at
+ * least 32 chars. Fixed dev-only values so launches are deterministic.
+ */
+function loginUiService() {
+    return `  login-ui:
+    image: oryd/kratos-selfservice-ui-node:latest
+    container_name: login-ui
+    mem_limit: 192m
+    cpus: "1.0"
+    ports:
+      - "${exports.LOGIN_UI_PORT}:${exports.LOGIN_UI_PORT}"
+    environment:
+      PORT: "${exports.LOGIN_UI_PORT}"
+      KRATOS_PUBLIC_URL: "http://kratos:${exports.KRATOS_PUBLIC_PORT}"
+      KRATOS_BROWSER_URL: "${exports.GATEWAY_URL}"
+      HYDRA_ADMIN_URL: "http://hydra:${exports.HYDRA_ADMIN_PORT}"
+      BASE_URL: "${exports.LOGIN_UI_URL}"
+      COOKIE_SECRET: "ory-agent-plugins-local-cookie-secret-32+"
+      CSRF_COOKIE_NAME: "ory_agent_plugins_local_csrf"
+      CSRF_COOKIE_SECRET: "ory-agent-plugins-local-csrf-secret-32+!"
+    depends_on:
+      - kratos
+      - hydra
+    networks:
+      - ory-local
+`;
+}
+function consoleService(cfg) {
+    // YAML-quote the paths to survive spaces; values are computed by us so
+    // they don't contain anything that needs deeper YAML escaping.
+    const context = JSON.stringify(cfg.buildContext ?? "");
+    const dockerfile = JSON.stringify(cfg.dockerfile ?? "Dockerfile");
+    const elements = JSON.stringify(cfg.elementsContext ?? "");
+    const buildMode = JSON.stringify(cfg.buildMode ?? "oss");
+    return `  console:
+    build:
+      context: ${context}
+      dockerfile: ${dockerfile}
+      additional_contexts:
+        elements: ${elements}
+      args:
+        NEXT_PUBLIC_BUILD_MODE: ${buildMode}
+    image: ory-console-lite:local
+    container_name: console
+    mem_limit: 512m
+    cpus: "1.0"
+    ports:
+      - "${exports.CONSOLE_PORT}:${CONSOLE_LITE_INTERNAL_PORT}"
+    # Console Lite (NEXT_PUBLIC_BUILD_MODE=oss) requires the upstream Ory
+    # service URLs at runtime; they're resolved over the docker network
+    # using the compose service hostnames + admin ports.
+    environment:
+      ORY_KRATOS_URL: "http://kratos:${exports.KRATOS_ADMIN_PORT}"
+      ORY_HYDRA_URL: "http://hydra:${exports.HYDRA_ADMIN_PORT}"
+      ORY_KETO_READ_URL: "http://keto:${exports.KETO_READ_PORT}"
+      ORY_KETO_WRITE_URL: "http://keto:${exports.KETO_WRITE_PORT}"
+    depends_on:
+      - kratos
+      - hydra
+      - keto
+    networks:
+      - ory-local
+`;
+}
+/**
+ * Render the docker-compose YAML.
+ *
+ * `consoleCfg` controls whether the optional Console UI service is
+ * emitted. When omitted, it is resolved via `getConsoleConfig(projectRoot)`.
+ * The nginx API gateway and the login UI are always emitted.
+ */
+function dockerComposeYaml(projectRoot, consoleCfg) {
+    const console = consoleCfg ?? getConsoleConfig(projectRoot);
+    const consoleBlock = console.enabled ? consoleService(console) : "";
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+name: ory-local
+
+services:
+  kratos:
+    image: oryd/kratos
+    container_name: kratos
+    command: serve -c /etc/config/kratos/kratos.yml --dev
+    mem_limit: 128m
+    cpus: "1.0"
+    ports:
+      - "4433:4433"
+      - "4434:4434"
+    volumes:
+      - ./kratos:/etc/config/kratos
+    networks:
+      - ory-local
+
+  keto:
+    image: oryd/keto
+    container_name: keto
+    command: serve -c /etc/config/keto/keto.yml
+    mem_limit: 128m
+    cpus: "1.0"
+    ports:
+      - "4466:4466"
+      - "4467:4467"
+    volumes:
+      - ./keto:/etc/config/keto
+    networks:
+      - ory-local
+
+  hydra:
+    image: oryd/hydra
+    container_name: hydra
+    command: serve -c /etc/config/hydra/hydra.yml all --dev
+    mem_limit: 128m
+    cpus: "1.0"
+    ports:
+      - "4444:4444" # Public port
+      - "4445:4445" # Admin port
+      - "5555:5555" # Port for hydra token user
+    volumes:
+      - ./hydra:/etc/config/hydra
+    networks:
+      - ory-local
+
+${nginxGatewayService()}
+${loginUiService()}
+${consoleBlock}  jaeger:
+    image: jaegertracing/all-in-one:1
+    container_name: jaeger
+    mem_limit: 384m
+    cpus: "1.0"
+    environment:
+      - COLLECTOR_OTLP_ENABLED=true
+      - LOG_LEVEL=warn
+    ports:
+      - "16686:16686"  # Jaeger UI
+      - "4318:4318"    # OTLP HTTP receiver
+    networks:
+      - ory-local
+
+
+networks:
+  ory-local:
+    driver: bridge
+`;
+}
+// ─── Kratos Configuration ──────────────────────────────────────────
+function kratosConfigYaml() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+dsn: memory
+
+serve:
+  public:
+    base_url: http://localhost:4433/
+    cors:
+      enabled: true
+      allowed_origins:
+        - '*'
+  admin:
+    base_url: http://localhost:4434/
+
+selfservice:
+  # Where Kratos sends browsers when there's no explicit return_to. The
+  # Console UI is the natural landing for humans; the PKCE flow itself
+  # always overrides this with its loopback return_to.
+  default_browser_return_url: ${exports.CONSOLE_URL}/
+  # All UI flows are served by the kratos-selfservice-ui-node service
+  # (login-ui), which Hydra also redirects to for OAuth2 login/consent.
+  flows:
+    registration:
+      enabled: true
+      ui_url: ${exports.LOGIN_UI_URL}/registration
+    login:
+      ui_url: ${exports.LOGIN_UI_URL}/login
+    settings:
+      ui_url: ${exports.LOGIN_UI_URL}/settings
+    error:
+      ui_url: ${exports.LOGIN_UI_URL}/error
+    verification:
+      enabled: false
+    recovery:
+      enabled: false
+
+oauth2_provider:
+  # Hydra admin URL, reachable over the docker network. Kratos's login
+  # flow uses this endpoint to accept the login_challenge query param
+  # that Hydra forwards through the login UI. Without it, Kratos returns
+  # "refusing to parse login_challenge query parameter because
+  # oauth2_provider.url is invalid or unset" and the OAuth2 flow stalls.
+  url: http://hydra:${exports.HYDRA_ADMIN_PORT}
+
+identity:
+  default_schema_id: agent
+  schemas:
+    - id: agent
+      url: file:///etc/config/kratos/identity-schema.json
+
+session:
+  lifespan: 720h
+  cookie:
+    same_site: Lax
+
+log:
+  level: debug
+
+secrets:
+  cookie:
+    - ory-agent-plugins-local-secret!!
+  cipher:
+    - ory-agent-plugins-local-cipher!!
+
+courier:
+  smtp:
+    connection_uri: smtp://localhost:1025/?disable_starttls=true
+`;
+}
+// ─── Kratos Identity Schema ────────────────────────────────────────
+function kratosIdentitySchema() {
+    return JSON.stringify({
+        $id: "https://ory-agent-plugins.local/identity.schema.json",
+        $schema: "http://json-schema.org/draft-07/schema#",
+        title: "Agent Identity",
+        type: "object",
+        properties: {
+            traits: {
+                type: "object",
+                properties: {
+                    email: {
+                        type: "string",
+                        format: "email",
+                        title: "Email",
+                        "ory.sh/kratos": {
+                            credentials: {
+                                password: { identifier: true },
+                            },
+                        },
+                    },
+                    name: {
+                        type: "string",
+                        title: "Name",
+                    },
+                },
+                required: ["email"],
+                additionalProperties: false,
+            },
+        },
+    }, null, 2);
+}
+// ─── Keto Configuration ────────────────────────────────────────────
+function ketoConfigYaml() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+dsn: memory
+
+serve:
+  read:
+    host: 0.0.0.0
+    port: 4466
+  write:
+    host: 0.0.0.0
+    port: 4467
+  metrics:
+    host: 0.0.0.0
+    port: 4468
+
+namespaces:
+  - id: 0
+    name: AgentTools
+  - id: 1
+    name: User
+
+log:
+  level: debug
+`;
+}
+// ─── Hydra Configuration ────────────────────────────────────────────
+function hydraConfigYaml() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+dsn: memory
+
+serve:
+  cookies:
+    same_site_mode: Lax
+
+urls:
+  self:
+    # Issuer is the host-reachable API gateway so JWT iss claims and the
+    # OIDC discovery document advertise URLs that resolve from outside
+    # the docker network (where browsers and the plugin run).
+    issuer: ${exports.GATEWAY_URL}
+  # Login + consent flow is handled by the kratos-selfservice-ui-node
+  # service. Hydra redirects the user's browser here with the
+  # login_challenge / consent_challenge query param.
+  consent: ${exports.LOGIN_UI_URL}/consent
+  login: ${exports.LOGIN_UI_URL}/login
+  logout: ${exports.LOGIN_UI_URL}/logout
+  error: ${exports.LOGIN_UI_URL}/error
+  device:
+    verification: ${exports.LOGIN_UI_URL}/device/verify
+    success: ${exports.LOGIN_UI_URL}/device/success
+
+secrets:
+  system:
+    - ory-agent-plugins-local-secret!!
+
+oidc:
+  subject_identifiers:
+    supported_types:
+      - pairwise
+      - public
+    pairwise:
+      salt: ory-agent-plugins-local-secret!!
+  dynamic_client_registration:
+    enabled: true
+    default_scope:
+      - openid
+      - offline_access
+
+log:
+  level: debug
+`;
+}
+// ─── Nginx Gateway ─────────────────────────────────────────────────
+/**
+ * Nginx config that acts as a unified API gateway, replicating what
+ * Ory Network does: route all API paths to the correct backend service
+ * so the @ory/client SDK works with a single basePath.
+ */
+function nginxConf() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+events {
+    worker_connections 256;
+}
+
+http {
+    resolver 127.0.0.11 valid=5s;
+
+    # Shared proxy settings
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    server {
+        listen 4000;
+        server_name localhost;
+
+        # ── Kratos public API ──────────────────────────────────
+        # Sessions (FrontendApi.toSession → GET /sessions/whoami)
+        location /sessions/ {
+            proxy_pass http://kratos:4433;
+        }
+
+        # Self-service flows (login, registration, etc.)
+        location /self-service/ {
+            proxy_pass http://kratos:4433;
+        }
+
+        # ── Kratos admin API ──────────────────────────────────
+        # Identity management
+        location /admin/identities {
+            proxy_pass http://kratos:4434;
+        }
+
+        # ── Hydra admin API ───────────────────────────────────
+        # Token introspection (OAuth2Api.introspectOAuth2Token → POST /admin/oauth2/introspect)
+        location /admin/oauth2/ {
+            proxy_pass http://hydra:4445;
+        }
+
+        # ── Hydra public API ──────────────────────────────────
+        location /oauth2/ {
+            proxy_pass http://hydra:4444;
+        }
+
+        location /.well-known/ {
+            proxy_pass http://hydra:4444;
+        }
+
+        # ── Keto read API ─────────────────────────────────────
+        # Permission checks (PermissionApi.checkPermission → GET /relation-tuples/check/openapi)
+        # Batch checks (PermissionApi.batchCheckPermission → POST /relation-tuples/batch-check)
+        # No trailing slash on the location so a bare GET /relation-tuples
+        # (the listing endpoint) also matches and proxies through.
+        location /relation-tuples {
+            proxy_pass http://keto:4466;
+        }
+
+        # ── Keto write API ────────────────────────────────────
+        # RelationshipApi.createRelationship issues PUT /admin/relation-tuples
+        # (no trailing slash), and deleteRelationships issues DELETE on the
+        # same path with query params. The location must match both the
+        # slashless form and any sub-path; dropping the trailing slash on
+        # the nginx location does both.
+        location /admin/relation-tuples {
+            proxy_pass http://keto:4467;
+        }
+
+        location /opl/ {
+            proxy_pass http://keto:4467;
+        }
+
+        # ── Gateway health ────────────────────────────────────
+        location /health {
+            default_type application/json;
+            return 200 '{"status":"ok","gateway":"ory-local"}';
+        }
+
+        # ── Fallback ──────────────────────────────────────────
+        location / {
+            default_type application/json;
+            return 404 '{"error":"not_found","message":"No Ory service handles this path"}';
+        }
+    }
+}
+`;
+}
+// ─── Default Ports ─────────────────────────────────────────────────
+exports.GATEWAY_PORT = 4000;
+exports.GATEWAY_URL = `http://localhost:${exports.GATEWAY_PORT}`;
+exports.CONSOLE_PORT = 4100;
+exports.CONSOLE_URL = `http://localhost:${exports.CONSOLE_PORT}`;
+exports.LOGIN_UI_PORT = 3000;
+exports.LOGIN_UI_URL = `http://localhost:${exports.LOGIN_UI_PORT}`;
+exports.KRATOS_PUBLIC_PORT = 4433;
+exports.KRATOS_ADMIN_PORT = 4434;
+exports.KETO_READ_PORT = 4466;
+exports.KETO_WRITE_PORT = 4467;
+exports.HYDRA_PUBLIC_PORT = 4444;
+exports.HYDRA_ADMIN_PORT = 4445;
+exports.JAEGER_UI_PORT = 16686;
+exports.JAEGER_OTLP_HTTP_PORT = 4318;
+exports.JAEGER_UI_URL = `http://localhost:${exports.JAEGER_UI_PORT}`;
+exports.JAEGER_OTLP_HTTP_URL = `http://localhost:${exports.JAEGER_OTLP_HTTP_PORT}`;
+/** URL the manager probes to confirm the gateway is healthy. */
+function gatewayHealthUrl() {
+    return `${exports.GATEWAY_URL}${getGatewayConfig().healthPath}`;
+}

package/dist/local/health.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Health-checking utilities for the local Ory development environment.
+ */
+export interface ServiceHealth {
+    name: string;
+    url: string;
+    healthy: boolean;
+    error?: string;
+}
+/**
+ * Check the health of all local Ory services.
+ *
+ * `gatewayUrl` overrides the gateway probe URL (used by the manager after
+ * a runtime gateway-mode fallback, where re-resolving via env var would
+ * give a stale path). When omitted, falls back to env-var resolution
+ * anchored at `projectRoot`.
+ */
+export declare function checkAllServices(options?: {
+    projectRoot?: string;
+    gatewayUrl?: string;
+}): Promise<ServiceHealth[]>;
+/**
+ * Wait for the gateway to become healthy, polling at the given interval.
+ * Returns true if healthy within the timeout, false otherwise.
+ *
+ * `gatewayUrl` overrides the probe URL (see `checkAllServices`). Otherwise
+ * the URL is computed from env-var resolution anchored at `projectRoot`.
+ */
+export declare function waitForGateway(timeoutMs?: number, intervalMs?: number, options?: {
+    projectRoot?: string;
+    gatewayUrl?: string;
+}): Promise<boolean>;