@ory/argus 0.1.0

package/dist/local/manager.js

@@ -0,0 +1,676 @@
+"use strict";
+/**
+ * Local Ory environment manager.
+ *
+ * Manages the Docker Compose lifecycle for running Kratos, Keto, Hydra,
+ * and an API gateway locally. The gateway defaults to Ory Console Lite when
+ * its source tree is present at `<projectRoot>/../cloud/console/console`,
+ * and falls back to the bundled nginx routing layer otherwise.
+ * `ORY_CONSOLE_LITE_PATH` overrides the path explicitly.
+ *
+ * Runtime directory: .ory-dev/ory/ (relative to where the command is run,
+ * or the project root when invoked from a plugin CLI). Sibling of
+ * .ory-dev/registry/ owned by the local npm registry manager.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLocalOryStack = ensureLocalOryStack;
+exports.localUp = localUp;
+exports.localDown = localDown;
+exports.localStatus = localStatus;
+exports.localSeed = localSeed;
+exports.localLogs = localLogs;
+exports.localReset = localReset;
+exports.localEnv = localEnv;
+exports.localConfigure = localConfigure;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const configs_js_1 = require("./configs.js");
+const health_js_1 = require("./health.js");
+const seed_js_1 = require("./seed.js");
+const config_js_1 = require("../config.js");
+const LOCAL_DIR_NAME = ".ory-dev/ory";
+async function isGatewayHealthy(timeoutMs, url) {
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify the Console Lite build context when it came from an explicit
+ * `ORY_CONSOLE_LITE_PATH` override. Default-resolved configs are skipped
+ * (resolution already proved the path is usable, and a missing default
+ * silently disables Console). Returns an error string when the explicit
+ * path is unusable, null otherwise.
+ */
+function validateConsoleConfig(cfg) {
+    if (!cfg.enabled || cfg.source !== "env")
+        return null;
+    const ctx = cfg.buildContext ?? "";
+    if (!ctx) {
+        return "ORY_CONSOLE_LITE_PATH is empty.";
+    }
+    if (!fs.existsSync(ctx)) {
+        return `ORY_CONSOLE_LITE_PATH=${ctx} does not exist.`;
+    }
+    const dockerfile = path.resolve(ctx, cfg.dockerfile ?? "Dockerfile");
+    if (!fs.existsSync(dockerfile)) {
+        return `Dockerfile not found at ${dockerfile} (set ORY_CONSOLE_LITE_DOCKERFILE to override).`;
+    }
+    const elements = cfg.elementsContext ?? "";
+    if (!elements) {
+        return "Elements context path is empty (set ORY_CONSOLE_LITE_ELEMENTS_PATH to override).";
+    }
+    if (!fs.existsSync(elements)) {
+        return (`Elements context not found at ${elements}. ` +
+            `Console Lite's Dockerfile expects '../../elements' relative to the console dir; ` +
+            `set ORY_CONSOLE_LITE_ELEMENTS_PATH to override.`);
+    }
+    return null;
+}
+/**
+ * Find the project root anchor for `.ory-dev/` and the Console Lite
+ * sibling-checkout default.
+ *
+ * Walks up to the outermost `.git` ancestor: this resolves to the
+ * workspace root from any sub-package, and to the main repo root from
+ * any worktree (where `.git` is a file pointer at the leaf and a real
+ * directory at the main checkout further up). Falls back to the first
+ * `package.json` ancestor when no `.git` is found (e.g. end users
+ * invoking via the plugin CLI inside their own project).
+ */
+function findProjectRoot(startDir) {
+    let dir = startDir;
+    let outermostGit = null;
+    let firstPackageJson = null;
+    while (dir !== path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, ".git"))) {
+            outermostGit = dir;
+        }
+        if (firstPackageJson === null &&
+            fs.existsSync(path.join(dir, "package.json"))) {
+            firstPackageJson = dir;
+        }
+        dir = path.dirname(dir);
+    }
+    return outermostGit ?? firstPackageJson ?? startDir;
+}
+function getLocalDir() {
+    const root = findProjectRoot(process.cwd());
+    return path.join(root, LOCAL_DIR_NAME);
+}
+function ensureDir(dir) {
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+/**
+ * Detect docker compose command. Prefers `docker compose` (v2),
+ * falls back to `docker-compose` (v1).
+ */
+function getComposeCommand() {
+    try {
+        (0, node_child_process_1.execSync)("docker compose version", { stdio: "ignore" });
+        return ["docker", "compose"];
+    }
+    catch {
+        try {
+            (0, node_child_process_1.execSync)("docker-compose version", { stdio: "ignore" });
+            return ["docker-compose"];
+        }
+        catch {
+            throw new Error("Docker Compose is not installed. Install Docker Desktop or docker-compose.");
+        }
+    }
+}
+function runCompose(composeArgs, localDir, opts) {
+    const cmd = getComposeCommand();
+    const args = [
+        ...cmd.slice(1),
+        "-f",
+        path.join(localDir, "docker-compose.yml"),
+        ...composeArgs,
+    ];
+    const result = (0, node_child_process_1.spawnSync)(cmd[0], args, {
+        cwd: localDir,
+        stdio: opts?.stdio ?? "inherit",
+        env: process.env,
+    });
+    return {
+        status: result.status ?? 1,
+        stdout: result.stdout?.toString(),
+        stderr: result.stderr?.toString(),
+    };
+}
+/**
+ * Dump captured output from a failing piped command to stderr so the user
+ * can see the underlying error. In non-piped mode, the output already
+ * streamed to the terminal — nothing to dump.
+ */
+function dumpCapturedOutput(label, result) {
+    const out = (result.stdout ?? "").trim();
+    const err = (result.stderr ?? "").trim();
+    if (!out && !err)
+        return;
+    process.stderr.write(`\n── ${label} output ──\n`);
+    if (out)
+        process.stderr.write(out + "\n");
+    if (err)
+        process.stderr.write(err + "\n");
+    process.stderr.write(`── end ${label} output ──\n\n`);
+}
+// ─── Write config files ────────────────────────────────────────────
+function writeConfigs(localDir, projectRoot, consoleCfg) {
+    ensureDir(localDir);
+    ensureDir(path.join(localDir, "kratos"));
+    ensureDir(path.join(localDir, "keto"));
+    ensureDir(path.join(localDir, "hydra"));
+    ensureDir(path.join(localDir, "nginx"));
+    fs.writeFileSync(path.join(localDir, "docker-compose.yml"), (0, configs_js_1.dockerComposeYaml)(projectRoot, consoleCfg));
+    fs.writeFileSync(path.join(localDir, "kratos", "kratos.yml"), (0, configs_js_1.kratosConfigYaml)());
+    fs.writeFileSync(path.join(localDir, "kratos", "identity-schema.json"), (0, configs_js_1.kratosIdentitySchema)());
+    fs.writeFileSync(path.join(localDir, "keto", "keto.yml"), (0, configs_js_1.ketoConfigYaml)());
+    fs.writeFileSync(path.join(localDir, "hydra", "hydra.yml"), (0, configs_js_1.hydraConfigYaml)());
+    // nginx config is always emitted — the gateway is no longer optional.
+    fs.writeFileSync(path.join(localDir, "nginx", "nginx.conf"), (0, configs_js_1.nginxConf)());
+}
+/**
+ * Bring up the local Ory stack and wait for the gateway to be healthy.
+ *
+ * Idempotent and fail-graceful: returns a typed result instead of exiting.
+ * If the gateway is already healthy the function short-circuits without
+ * touching Docker. When `quiet` is set, progress is logged to stderr only
+ * (suitable for the dev launcher); otherwise it prints to stdout in the
+ * format `localUp` historically used.
+ */
+async function ensureLocalOryStack(opts = {}) {
+    const localDir = opts.localDir ?? getLocalDir();
+    const projectRoot = path.dirname(localDir);
+    const log = opts.quiet
+        ? (s) => process.stderr.write(s + "\n")
+        : (s) => console.log(s);
+    let consoleCfg = (0, configs_js_1.getConsoleConfig)(projectRoot);
+    const cfgError = validateConsoleConfig(consoleCfg);
+    if (cfgError) {
+        return { status: "console-misconfigured", localDir, detail: cfgError };
+    }
+    const gatewayCfg = (0, configs_js_1.getGatewayConfig)();
+    const healthUrl = `${configs_js_1.GATEWAY_URL}${gatewayCfg.healthPath}`;
+    // Short-circuit if the gateway is already serving — keeps repeated dev
+    // launches fast and avoids re-pulling/restarting healthy containers.
+    // Skip the short-circuit when ORY_CONSOLE_LITE_PATH is explicitly set so
+    // a path change on a subsequent run actually triggers a rebuild (compose
+    // diffs the regenerated YAML and recreates the console when needed).
+    const explicitConsoleLiteOverride = (process.env.ORY_CONSOLE_LITE_PATH ?? "").trim() !== "";
+    if (!explicitConsoleLiteOverride &&
+        (await isGatewayHealthy(1_500, healthUrl))) {
+        return { status: "already-running", gatewayUrl: configs_js_1.GATEWAY_URL, localDir };
+    }
+    try {
+        (0, node_child_process_1.execSync)("docker info", { stdio: "ignore" });
+    }
+    catch {
+        return {
+            status: "skipped:no-docker",
+            localDir,
+            detail: "Docker is not running. Start Docker Desktop and try again.",
+        };
+    }
+    writeConfigs(localDir, projectRoot, consoleCfg);
+    log("  Config files written.");
+    log("  Gateway: bundled nginx API passthrough.");
+    log("  Login UI: oryd/kratos-selfservice-ui-node.");
+    if (consoleCfg.enabled) {
+        const sourceLabel = consoleCfg.source === "default"
+            ? "default sibling checkout"
+            : "ORY_CONSOLE_LITE_PATH";
+        log(`  Console: Ory Console Lite (${sourceLabel} → ${consoleCfg.buildContext}).`);
+        log(`    Elements build context: ${consoleCfg.elementsContext}`);
+        log(`    NEXT_PUBLIC_BUILD_MODE: ${consoleCfg.buildMode}`);
+    }
+    else {
+        log("  Console: disabled (Console Lite source not found at default path).");
+    }
+    log("  Pulling Docker images (first run may take a minute)...");
+    const pullResult = runCompose(["pull", "--quiet"], localDir, {
+        stdio: opts.quiet ? "pipe" : "inherit",
+    });
+    if (pullResult.status !== 0) {
+        log("  Warning: Some images may not have pulled. Continuing...");
+    }
+    if (consoleCfg.enabled) {
+        log("  Building Ory Console Lite image (first run may take a few minutes)...");
+        const buildResult = runCompose(["build", "console"], localDir, {
+            stdio: opts.quiet ? "pipe" : "inherit",
+        });
+        if (buildResult.status !== 0) {
+            // Surface the actual build error first — in dev launcher (quiet)
+            // mode the build runs piped, so without dumping the captured
+            // output the user only sees "exit N" with no clue why.
+            dumpCapturedOutput("docker compose build console", buildResult);
+            // Graceful fallback: a Console Lite source-tree build failure
+            // shouldn't block the rest of the local stack from coming up.
+            // Disable Console for this run, regenerate the compose YAML
+            // without it, and continue. The rest of the stack (API gateway,
+            // login UI, Kratos/Hydra/Keto, Jaeger) is unaffected. The user
+            // can fix the cloud repo and rerun to bring Console back.
+            log(`  Warning: Ory Console Lite build failed (exit ${buildResult.status}). ` +
+                `Continuing without Console — the rest of the stack will come up. ` +
+                `Re-run the build directly to iterate: cd ${localDir} && docker compose build console`);
+            consoleCfg = { enabled: false };
+            writeConfigs(localDir, projectRoot, consoleCfg);
+        }
+    }
+    log("  Starting services...");
+    const upResult = runCompose(["up", "-d", "--wait"], localDir, {
+        stdio: opts.quiet ? "pipe" : "inherit",
+    });
+    if (upResult.status !== 0) {
+        dumpCapturedOutput("docker compose up", upResult);
+        return {
+            status: "compose-failed",
+            localDir,
+            detail: `docker compose up exited ${upResult.status}.`,
+        };
+    }
+    log("  Waiting for gateway to become healthy...");
+    const healthy = await (0, health_js_1.waitForGateway)(120_000, 2000, {
+        gatewayUrl: healthUrl,
+    });
+    if (!healthy) {
+        return {
+            status: "gateway-unhealthy",
+            localDir,
+            detail: "Gateway did not become healthy within 2 minutes.",
+        };
+    }
+    return { status: "started", gatewayUrl: configs_js_1.GATEWAY_URL, localDir };
+}
+async function localUp(opts = {}) {
+    console.log("Setting up local Ory environment...");
+    console.log(`  Directory: ${getLocalDir()}`);
+    console.log("");
+    const result = await ensureLocalOryStack();
+    switch (result.status) {
+        case "skipped:no-docker":
+        case "console-misconfigured":
+            console.error(`Error: ${result.detail}`);
+            process.exit(1);
+        case "compose-failed":
+        case "gateway-unhealthy":
+            console.error(`Error: ${result.detail}`);
+            console.error("Check service logs:");
+            console.error(`  cd ${result.localDir} && docker compose logs`);
+            process.exit(1);
+        case "already-running":
+            console.log("  Stack already running — reusing.");
+            break;
+        case "started":
+            console.log("");
+            console.log("  All services are running!");
+            console.log("");
+            break;
+    }
+    // Seed if requested
+    if (opts.seed !== false) {
+        try {
+            const result = await (0, seed_js_1.seedLocalEnvironment)();
+            printSeedResult(result);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`\nWarning: Seed failed: ${msg}`);
+            console.error("Services are running — you can seed later with: local seed");
+        }
+    }
+    else {
+        printConnectionInfo();
+    }
+}
+/**
+ * List container IDs labelled as part of the `ory-local` Compose project.
+ * Returns an empty array on any docker error (e.g. daemon unreachable).
+ */
+function findOryLocalContainers() {
+    try {
+        const result = (0, node_child_process_1.spawnSync)("docker", [
+            "ps",
+            "-a",
+            "-q",
+            "--filter",
+            "label=com.docker.compose.project=ory-local",
+        ], { encoding: "utf-8" });
+        if (result.status !== 0)
+            return [];
+        return (result.stdout ?? "")
+            .split("\n")
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+async function localDown() {
+    const localDir = getLocalDir();
+    if (fs.existsSync(path.join(localDir, "docker-compose.yml"))) {
+        console.log("Stopping local Ory environment...");
+        runCompose(["down"], localDir);
+        console.log("Done. Data volumes are preserved. Use 'local reset' to remove everything.");
+        return;
+    }
+    // No compose file at the resolved localDir — fall back to label-based
+    // discovery so a runaway stack started from a different cwd (e.g. an
+    // older worktree) can still be torn down.
+    const ids = findOryLocalContainers();
+    if (ids.length === 0) {
+        console.log("No local Ory environment found. Nothing to stop.");
+        return;
+    }
+    console.log(`No compose file at ${localDir}, but found ${ids.length} container(s) ` +
+        `with the 'ory-local' Compose project label. Stopping them directly...`);
+    const rm = (0, node_child_process_1.spawnSync)("docker", ["rm", "-f", ...ids], { stdio: "inherit" });
+    if (rm.status !== 0) {
+        console.error(`Warning: 'docker rm -f' exited ${rm.status}. Some containers may still be running.`);
+        return;
+    }
+    console.log("Done. Data volumes are preserved. Use 'local reset' to remove everything.");
+}
+async function localStatus() {
+    const localDir = getLocalDir();
+    const projectRoot = path.dirname(localDir);
+    console.log("Local Ory Environment Status");
+    console.log("============================");
+    console.log("");
+    console.log(`  Directory: ${localDir}`);
+    console.log(`  Gateway:   ${configs_js_1.GATEWAY_URL}`);
+    console.log("");
+    // Check if compose file exists
+    if (!fs.existsSync(path.join(localDir, "docker-compose.yml"))) {
+        console.log("  Status: NOT INITIALIZED");
+        console.log("  Run 'local up' to start the local Ory environment.");
+        return;
+    }
+    // Check container states
+    const ps = runCompose(["ps", "--format", "json"], localDir, {
+        stdio: "pipe",
+    });
+    if (ps.stdout) {
+        // docker compose ps --format json outputs one JSON object per line
+        const lines = ps.stdout.trim().split("\n").filter(Boolean);
+        let running = 0;
+        let total = 0;
+        for (const line of lines) {
+            try {
+                const container = JSON.parse(line);
+                total++;
+                const isRunning = container.State === "running";
+                if (isRunning)
+                    running++;
+                const icon = isRunning ? "+" : "!";
+                const health = container.Health ? ` (${container.Health})` : "";
+                console.log(`  [${icon}] ${container.Name}: ${container.State}${health}`);
+            }
+            catch {
+                // May not be JSON — older docker-compose versions
+            }
+        }
+        if (total > 0) {
+            console.log("");
+            console.log(`  ${running}/${total} containers running`);
+        }
+    }
+    // Health check endpoints
+    console.log("");
+    console.log("Service Health:");
+    const health = await (0, health_js_1.checkAllServices)({ projectRoot });
+    for (const svc of health) {
+        const icon = svc.healthy ? "+" : "!";
+        const status = svc.healthy ? "healthy" : `unhealthy: ${svc.error}`;
+        console.log(`  [${icon}] ${svc.name}: ${status}`);
+    }
+}
+async function localSeed() {
+    const namespace = process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+    try {
+        const result = await (0, seed_js_1.seedLocalEnvironment)(namespace);
+        printSeedResult(result);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Seed failed: ${msg}`);
+        console.error("");
+        console.error("Make sure the local environment is running: local up");
+        process.exit(1);
+    }
+}
+function localLogs(args) {
+    const localDir = getLocalDir();
+    if (!fs.existsSync(path.join(localDir, "docker-compose.yml"))) {
+        console.log("No local Ory environment found. Run 'local up' first.");
+        return;
+    }
+    const service = args[0]; // Optional: filter to a specific service
+    const composeArgs = ["logs", "--tail", "50"];
+    if (args.includes("-f") || args.includes("--follow")) {
+        composeArgs.push("-f");
+    }
+    if (service && !service.startsWith("-")) {
+        composeArgs.push(service);
+    }
+    runCompose(composeArgs, localDir);
+}
+/**
+ * List named volumes labelled as part of the `ory-local` Compose project.
+ *
+ * Anonymous volumes created by container `VOLUME` directives (e.g. some Ory
+ * service images) only carry `com.docker.volume.anonymous` and so won't show
+ * up here — capture those via `findContainerVolumes` BEFORE removing the
+ * containers, since once the containers are gone those volumes can no longer
+ * be associated with the project.
+ */
+function findOryLocalVolumes() {
+    try {
+        const result = (0, node_child_process_1.spawnSync)("docker", [
+            "volume",
+            "ls",
+            "-q",
+            "--filter",
+            "label=com.docker.compose.project=ory-local",
+        ], { encoding: "utf-8" });
+        if (result.status !== 0)
+            return [];
+        return (result.stdout ?? "")
+            .split("\n")
+            .map((s) => s.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * For the given container IDs, return all volume names mounted into them
+ * (named + anonymous). Used to capture volume IDs before `docker rm` so
+ * anonymous volumes don't become unrecoverable orphans.
+ */
+function findContainerVolumes(containerIds) {
+    if (containerIds.length === 0)
+        return [];
+    try {
+        const result = (0, node_child_process_1.spawnSync)("docker", [
+            "inspect",
+            "--format",
+            '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}}\n{{end}}{{end}}',
+            ...containerIds,
+        ], { encoding: "utf-8" });
+        if (result.status !== 0)
+            return [];
+        const seen = new Set();
+        for (const line of (result.stdout ?? "").split("\n")) {
+            const v = line.trim();
+            if (v)
+                seen.add(v);
+        }
+        return [...seen];
+    }
+    catch {
+        return [];
+    }
+}
+async function localReset() {
+    const localDir = getLocalDir();
+    const composeExists = fs.existsSync(path.join(localDir, "docker-compose.yml"));
+    if (composeExists) {
+        console.log("Resetting local Ory environment (removing all data)...");
+        runCompose(["down", "-v"], localDir);
+        console.log("Data volumes removed.");
+    }
+    else {
+        // Fall back to label-based discovery so an orphan stack from a
+        // different cwd (e.g. an older worktree) can still be torn down.
+        const containerIds = findOryLocalContainers();
+        // Capture volume IDs from running containers BEFORE removing them —
+        // once the containers are gone, anonymous volumes (which carry no
+        // compose-project label) can't be tied back to the project.
+        const containerVolumes = findContainerVolumes(containerIds);
+        const labelledVolumes = findOryLocalVolumes();
+        const allVolumes = [
+            ...new Set([...containerVolumes, ...labelledVolumes]),
+        ];
+        if (containerIds.length === 0 && allVolumes.length === 0) {
+            console.log("No local Ory environment found. Nothing to reset.");
+            return;
+        }
+        console.log(`No compose file at ${localDir}, but found ${containerIds.length} container(s) ` +
+            `and ${allVolumes.length} volume(s) tied to the 'ory-local' Compose project. ` +
+            `Removing them directly...`);
+        if (containerIds.length > 0) {
+            // -v removes anonymous volumes attached to these containers.
+            const rm = (0, node_child_process_1.spawnSync)("docker", ["rm", "-fv", ...containerIds], {
+                stdio: "inherit",
+            });
+            if (rm.status !== 0) {
+                console.error(`Warning: 'docker rm -fv' exited ${rm.status}. Some containers may still be running.`);
+            }
+        }
+        if (allVolumes.length > 0) {
+            // Belt-and-suspenders: remove any volumes still around (named, or
+            // anonymous if -v didn't catch them because the container was
+            // already gone).
+            const vrm = (0, node_child_process_1.spawnSync)("docker", ["volume", "rm", "-f", ...allVolumes], { stdio: "inherit" });
+            if (vrm.status !== 0) {
+                console.error(`Warning: 'docker volume rm' exited ${vrm.status}. Some volumes may remain.`);
+            }
+        }
+        console.log("Data volumes removed.");
+    }
+    // Remove config files (no-op if directory is absent)
+    if (fs.existsSync(localDir)) {
+        fs.rmSync(localDir, { recursive: true, force: true });
+        console.log(`Removed ${localDir}`);
+    }
+    console.log("");
+    console.log("Run 'local up' to start fresh.");
+}
+function localEnv() {
+    console.log("# Add these to your shell profile or .env file:");
+    console.log(`export ORY_PROJECT_URL=${configs_js_1.GATEWAY_URL}`);
+    console.log("export ORY_AGENT_DEBUG=true");
+    console.log("");
+    console.log("# If you ran 'local seed', also set the session token:");
+    console.log("# export ORY_SESSION_TOKEN=<token from seed output>");
+    console.log("");
+    console.log("# Ship traces to the bundled Jaeger (UI: http://localhost:16686):");
+    console.log(`export OTEL_EXPORTER_OTLP_ENDPOINT=${configs_js_1.JAEGER_OTLP_HTTP_URL}`);
+}
+function localConfigure() {
+    console.log(`Saving local Ory gateway URL to shared config...`);
+    (0, config_js_1.saveConfig)({ projectUrl: configs_js_1.GATEWAY_URL, auditOnly: false });
+    console.log(`  Project URL: ${configs_js_1.GATEWAY_URL}`);
+    console.log("");
+    console.log("All Ory agent plugins will now connect to the local environment.");
+    console.log("This persists across sessions. Run 'configure --project-url <URL>'");
+    console.log("to switch back to a remote Ory project.");
+}
+// ─── Helpers ───────────────────────────────────────────────────────
+function printSeedResult(result) {
+    console.log("");
+    console.log("Seed complete!");
+    console.log("==============");
+    console.log("");
+    console.log(`  Agent identity: ${result.agent.identity.email} (${result.agent.identity.id})`);
+    console.log(`                  (OAuth2 client self-registers on first run via DCR)`);
+    console.log("");
+    console.log(`  User identity:  ${result.user.identity.email} (${result.user.identity.id})`);
+    console.log(`  User password:  ${result.user.password}`);
+    console.log(`  User OAuth2:    ${result.user.client.clientId} (PKCE)`);
+    console.log("");
+    console.log(`  Permissions: ${result.permissions.tuples} tuples in '${result.permissions.namespace}' for ${result.permissions.subject}`);
+    console.log("");
+    console.log("To use with any Ory agent plugin, set these environment variables:");
+    console.log("");
+    console.log(`  export ORY_PROJECT_URL=${configs_js_1.GATEWAY_URL}`);
+    console.log(`  export ORY_AUTH_GATE=1`);
+    console.log(`  export ORY_OAUTH2_CLIENT_ID=${result.user.client.clientId}`);
+    console.log(`  export ORY_USER_SUBJECT_NAMESPACE=User`);
+    console.log(`  export ORY_USER_SUBJECT_ID=${result.user.identity.id}`);
+    console.log("");
+    console.log("The user gate runs PKCE in the browser — sign in with the email and");
+    console.log("password printed above. The agent OAuth2 client is registered");
+    console.log("automatically via Dynamic Client Registration (RFC 7591) on first");
+    console.log("session using the user's bearer as the initial access token.");
+    console.log("");
+    console.log("Or save the project URL to the shared config (persists across sessions):");
+    console.log("");
+    console.log("  npx ory-<harness> local configure");
+}
+function printConnectionInfo() {
+    console.log("Connection Info");
+    console.log("===============");
+    console.log("");
+    console.log(`  Gateway URL: ${configs_js_1.GATEWAY_URL}`);
+    console.log(`  Kratos:      http://localhost:4433 (public) / http://localhost:4434 (admin)`);
+    console.log(`  Keto:        http://localhost:4466 (read) / http://localhost:4467 (write)`);
+    console.log(`  Hydra:       http://localhost:4444 (public) / http://localhost:4445 (admin)`);
+    console.log(`  Jaeger UI:   ${configs_js_1.JAEGER_UI_URL}`);
+    console.log(`  OTLP HTTP:   ${configs_js_1.JAEGER_OTLP_HTTP_URL} (set OTEL_EXPORTER_OTLP_ENDPOINT to ship traces)`);
+    console.log("");
+    console.log("Run 'local seed' to create test data, or 'local env' to print env vars.");
+}