@ory/argus 0.14.0 → 1.0.0

package/dist/local/configs.js

@@ -39,25 +39,30 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JAEGER_OTLP_HTTP_URL = exports.JAEGER_UI_URL = exports.JAEGER_OTLP_HTTP_PORT = exports.JAEGER_UI_PORT = exports.HYDRA_ADMIN_PORT = exports.HYDRA_PUBLIC_PORT = exports.KETO_WRITE_PORT = exports.KETO_READ_PORT = exports.KRATOS_ADMIN_PORT = exports.KRATOS_PUBLIC_PORT = exports.LOGIN_UI_URL = exports.LOGIN_UI_PORT = exports.CONSOLE_URL = exports.CONSOLE_PORT = exports.GATEWAY_URL = exports.GATEWAY_PORT = exports.DEFAULT_CONSOLE_LITE_SUBPATH = void 0;
+exports.OATHKEEPER_API_PORT = exports.OATHKEEPER_PROXY_PORT = exports.HYDRA_TOKEN_USER_PORT = exports.HYDRA_ADMIN_PORT = exports.HYDRA_PUBLIC_PORT = exports.KETO_WRITE_PORT = exports.KETO_READ_PORT = exports.KRATOS_ADMIN_PORT = exports.KRATOS_PUBLIC_PORT = exports.LOGIN_UI_URL = exports.LOGIN_UI_PORT = exports.CONSOLE_URL = exports.CONSOLE_PORT = exports.GATEWAY_URL = exports.GATEWAY_PORT = exports.LOCAL_STACK_HOST_SOURCE = exports.LOCAL_STACK_HOST = exports.LOCAL_PORT_WARNINGS = exports.DEFAULT_CONSOLE_LITE_SUBPATH = void 0;
 exports.getGatewayConfig = getGatewayConfig;
 exports.getConsoleConfig = getConsoleConfig;
+exports.getOathkeeperConfig = getOathkeeperConfig;
 exports.dockerComposeYaml = dockerComposeYaml;
 exports.kratosConfigYaml = kratosConfigYaml;
 exports.kratosIdentitySchema = kratosIdentitySchema;
 exports.ketoConfigYaml = ketoConfigYaml;
 exports.hydraConfigYaml = hydraConfigYaml;
+exports.oathkeeperConfigYaml = oathkeeperConfigYaml;
+exports.oathkeeperAccessRulesYaml = oathkeeperAccessRulesYaml;
 exports.nginxConf = nginxConf;
+exports.getLocalPorts = getLocalPorts;
 exports.gatewayHealthUrl = gatewayHealthUrl;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const ports_js_1 = require("./ports.js");
 /** Default location of the Console Lite source tree, sibling-checkout layout. */
 exports.DEFAULT_CONSOLE_LITE_SUBPATH = path.join("..", "cloud", "console", "console");
 /**
  * Console Lite listens on this container-internal port (Dockerfile sets
  * `ENV PORT=3000`). Bound to the host on CONSOLE_PORT.
  */
-const CONSOLE_LITE_INTERNAL_PORT = 3000;
+const CONSOLE_LITE_INTERNAL_PORT = ports_js_1.CONSOLE_CONTAINER_PORT;
 /**
  * The Console Lite Dockerfile builds from the **cloud monorepo root**, not the
  * console app dir: it `COPY`s `package.json`, `pnpm-workspace.yaml`,
@@ -188,21 +193,73 @@ function getConsoleConfig(projectRoot) {
     }
     return consoleConfig(buildContext, dockerfile, elementsContext, buildMode, source);
 }
+/**
+ * Resolve whether the local stack should front Keto's token-authenticated
+ * `/user/*` read path with a real **Oathkeeper** service.
+ *
+ * **On by default** so the local stack mirrors the hosted token-introspection
+ * contract: an Oathkeeper service configured like the hosted
+ * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
+ * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
+ * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
+ * read permissions locally, exactly as it is on a hosted Ory project. (The
+ * plugin's agent DCR / user PKCE tokens are populated before any permission read
+ * runs, so this is transparent in the normal flow.)
+ *
+ * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
+ * to a transparent nginx passthrough that strips `/user` and forwards straight to
+ * keto-read with **no** auth — a leaner stack that matches the hosted *path shape*
+ * only, useful when iterating on something unrelated to the auth layer.
+ */
+function getOathkeeperConfig() {
+    const raw = (process.env.ORY_LOCAL_OATHKEEPER ?? "").trim().toLowerCase();
+    const disabled = raw === "0" || raw === "false" || raw === "no" || raw === "off";
+    return { enabled: !disabled };
+}
 // ─── Docker Compose ────────────────────────────────────────────────
-function nginxGatewayService() {
+function nginxGatewayService(oathkeeperEnabled) {
+    // When Oathkeeper fronts the /user/* path, the gateway proxies those reads to
+    // it, so order Oathkeeper's start ahead of the gateway (nginx resolves the
+    // upstream name at config load).
+    const oathkeeperDep = oathkeeperEnabled ? "      - oathkeeper\n" : "";
     return `  gateway:
     image: nginx:alpine
     container_name: gateway
     mem_limit: 128m
     cpus: "1.0"
     ports:
-      - "${exports.GATEWAY_PORT}:${exports.GATEWAY_PORT}"
+      - "${exports.GATEWAY_PORT}:${ports_js_1.GATEWAY_CONTAINER_PORT}"
     volumes:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
     depends_on:
       - kratos
       - hydra
       - keto
+${oathkeeperDep}    networks:
+      - ory-local
+`;
+}
+/**
+ * Oathkeeper service that fronts Keto's `/user/*` read path with real OAuth2
+ * token introspection, mirroring the hosted access rule. Only emitted when
+ * `ORY_LOCAL_OATHKEEPER` is set. Serves the proxy (where the gateway forwards
+ * `/user/*`) and the read/rule API.
+ */
+function oathkeeperService() {
+    return `  oathkeeper:
+    image: oryd/oathkeeper
+    container_name: oathkeeper
+    command: serve -c /etc/config/oathkeeper/oathkeeper.yml
+    mem_limit: 128m
+    cpus: "1.0"
+    ports:
+      - "${exports.OATHKEEPER_PROXY_PORT}:${ports_js_1.OATHKEEPER_PROXY_CONTAINER_PORT}"
+      - "${exports.OATHKEEPER_API_PORT}:${ports_js_1.OATHKEEPER_API_CONTAINER_PORT}"
+    volumes:
+      - ./oathkeeper:/etc/config/oathkeeper
+    depends_on:
+      - hydra
+      - keto
     networks:
       - ory-local
 `;
@@ -233,12 +290,12 @@ function loginUiService() {
     mem_limit: 192m
     cpus: "1.0"
     ports:
-      - "${exports.LOGIN_UI_PORT}:${exports.LOGIN_UI_PORT}"
+      - "${exports.LOGIN_UI_PORT}:${ports_js_1.LOGIN_UI_CONTAINER_PORT}"
     environment:
-      PORT: "${exports.LOGIN_UI_PORT}"
-      KRATOS_PUBLIC_URL: "http://kratos:${exports.KRATOS_PUBLIC_PORT}"
+      PORT: "${ports_js_1.LOGIN_UI_CONTAINER_PORT}"
+      KRATOS_PUBLIC_URL: "http://kratos:${ports_js_1.KRATOS_PUBLIC_CONTAINER_PORT}"
       KRATOS_BROWSER_URL: "${exports.GATEWAY_URL}"
-      HYDRA_ADMIN_URL: "http://hydra:${exports.HYDRA_ADMIN_PORT}"
+      HYDRA_ADMIN_URL: "http://hydra:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT}"
       BASE_URL: "${exports.LOGIN_UI_URL}"
       COOKIE_SECRET: "ory-agent-plugins-local-cookie-secret-32+"
       CSRF_COOKIE_NAME: "ory_agent_plugins_local_csrf"
@@ -276,10 +333,10 @@ function consoleService(cfg) {
     # service URLs at runtime; they're resolved over the docker network
     # using the compose service hostnames + admin ports.
     environment:
-      ORY_KRATOS_URL: "http://kratos:${exports.KRATOS_ADMIN_PORT}"
-      ORY_HYDRA_URL: "http://hydra:${exports.HYDRA_ADMIN_PORT}"
-      ORY_KETO_READ_URL: "http://keto:${exports.KETO_READ_PORT}"
-      ORY_KETO_WRITE_URL: "http://keto:${exports.KETO_WRITE_PORT}"
+      ORY_KRATOS_URL: "http://kratos:${ports_js_1.KRATOS_ADMIN_CONTAINER_PORT}"
+      ORY_HYDRA_URL: "http://hydra:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT}"
+      ORY_KETO_READ_URL: "http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT}"
+      ORY_KETO_WRITE_URL: "http://keto:${ports_js_1.KETO_WRITE_CONTAINER_PORT}"
     depends_on:
       - kratos
       - hydra
@@ -295,9 +352,11 @@ function consoleService(cfg) {
  * emitted. When omitted, it is resolved via `getConsoleConfig(projectRoot)`.
  * The nginx API gateway and the login UI are always emitted.
  */
-function dockerComposeYaml(projectRoot, consoleCfg) {
+function dockerComposeYaml(projectRoot, consoleCfg, oathkeeperCfg) {
     const console = consoleCfg ?? getConsoleConfig(projectRoot);
     const consoleBlock = console.enabled ? consoleService(console) : "";
+    const oathkeeper = oathkeeperCfg ?? getOathkeeperConfig();
+    const oathkeeperBlock = oathkeeper.enabled ? oathkeeperService() : "";
     return `# Generated by @ory-agent-plugins — local development environment
 # Do not edit manually; re-run "local up" to regenerate.
 
@@ -311,8 +370,8 @@ services:
     mem_limit: 128m
     cpus: "1.0"
     ports:
-      - "4433:4433"
-      - "4434:4434"
+      - "${exports.KRATOS_PUBLIC_PORT}:${ports_js_1.KRATOS_PUBLIC_CONTAINER_PORT}"
+      - "${exports.KRATOS_ADMIN_PORT}:${ports_js_1.KRATOS_ADMIN_CONTAINER_PORT}"
     volumes:
       - ./kratos:/etc/config/kratos
     networks:
@@ -325,8 +384,8 @@ services:
     mem_limit: 128m
     cpus: "1.0"
     ports:
-      - "4466:4466"
-      - "4467:4467"
+      - "${exports.KETO_READ_PORT}:${ports_js_1.KETO_READ_CONTAINER_PORT}"
+      - "${exports.KETO_WRITE_PORT}:${ports_js_1.KETO_WRITE_CONTAINER_PORT}"
     volumes:
       - ./keto:/etc/config/keto
     networks:
@@ -339,31 +398,17 @@ services:
     mem_limit: 128m
     cpus: "1.0"
     ports:
-      - "4444:4444" # Public port
-      - "4445:4445" # Admin port
-      - "5555:5555" # Port for hydra token user
+      - "${exports.HYDRA_PUBLIC_PORT}:${ports_js_1.HYDRA_PUBLIC_CONTAINER_PORT}" # Public port
+      - "${exports.HYDRA_ADMIN_PORT}:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT}" # Admin port
+      - "${exports.HYDRA_TOKEN_USER_PORT}:${ports_js_1.HYDRA_TOKEN_USER_CONTAINER_PORT}" # Port for hydra token user
     volumes:
       - ./hydra:/etc/config/hydra
     networks:
       - ory-local
 
-${nginxGatewayService()}
-${loginUiService()}
-${consoleBlock}  jaeger:
-    image: jaegertracing/all-in-one:1
-    container_name: jaeger
-    mem_limit: 384m
-    cpus: "1.0"
-    environment:
-      - COLLECTOR_OTLP_ENABLED=true
-      - LOG_LEVEL=warn
-    ports:
-      - "16686:16686"  # Jaeger UI
-      - "4318:4318"    # OTLP HTTP receiver
-    networks:
-      - ory-local
-
-
+${nginxGatewayService(oathkeeper.enabled)}
+${oathkeeperBlock}${loginUiService()}
+${consoleBlock}
 networks:
   ory-local:
     driver: bridge
@@ -378,13 +423,15 @@ dsn: memory
 
 serve:
   public:
-    base_url: http://localhost:4433/
+    # Host-reachable base URLs: Kratos advertises these outward, so they carry
+    # the host port and the advertised host, not the container-internal pair.
+    base_url: ${(0, ports_js_1.hostUrl)(LOCAL_HOST, exports.KRATOS_PUBLIC_PORT)}/
     cors:
       enabled: true
       allowed_origins:
         - '*'
   admin:
-    base_url: http://localhost:4434/
+    base_url: ${(0, ports_js_1.hostUrl)(LOCAL_HOST, exports.KRATOS_ADMIN_PORT)}/
 
 selfservice:
   # Where Kratos sends browsers when there's no explicit return_to. The
@@ -414,7 +461,7 @@ oauth2_provider:
   # that Hydra forwards through the login UI. Without it, Kratos returns
   # "refusing to parse login_challenge query parameter because
   # oauth2_provider.url is invalid or unset" and the OAuth2 flow stalls.
-  url: http://hydra:${exports.HYDRA_ADMIN_PORT}
+  url: http://hydra:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT}
 
 identity:
   default_schema_id: agent
@@ -481,21 +528,32 @@ function ketoConfigYaml() {
 dsn: memory
 
 serve:
+  # Container-internal listen ports. These stay fixed no matter which host
+  # ports the stack publishes on — they are what the other services address
+  # over the compose network (\`http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT}\`).
   read:
     host: 0.0.0.0
-    port: 4466
+    port: ${ports_js_1.KETO_READ_CONTAINER_PORT}
   write:
     host: 0.0.0.0
-    port: 4467
+    port: ${ports_js_1.KETO_WRITE_CONTAINER_PORT}
   metrics:
     host: 0.0.0.0
     port: 4468
 
+# Namespaces are defined via the Ory Permission Language (OPL) file rather
+# than the inline id/name list, so the AgentTool namespace can carry a
+# block-aware permit (\`access = use && !blocked\`) instead of relying purely
+# on relation-tuple existence. See buildAgentSecurityOpl() in ../opl.ts.
 namespaces:
-  - id: 0
-    name: AgentTools
-  - id: 1
-    name: User
+  location: file:///etc/config/keto/namespaces.keto.ts
+
+# Shell-command decomposition (issue #76) checks each command word in a batch.
+# Keto's default cap is 10; raise it so the local stack matches the gate's
+# chunking headroom and word-heavy commands stay in as few round-trips as
+# possible. The gate still chunks defensively for real projects on the default.
+limit:
+  max_batch_check_size: 100
 
 log:
   level: debug
@@ -550,13 +608,136 @@ log:
   level: debug
 `;
 }
+// ─── Oathkeeper Configuration (optional /user override) ────────────
+/**
+ * Oathkeeper server config. Only written when `ORY_LOCAL_OATHKEEPER` is set.
+ *
+ * Serves the proxy (the gateway forwards `/user/*` here) and the API port, and
+ * declares the handlers the access rule references: the `oauth2_introspection`
+ * authenticator introspects the plugin's OAuth2 access token against Hydra's
+ * admin introspection endpoint, `allow` authorizes, and `noop` mutates. Rules
+ * use the `regexp` matching strategy so the `/user/*` URL pattern resolves.
+ */
+function oathkeeperConfigYaml() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+serve:
+  # Container-internal listen ports; the gateway reaches the proxy over the
+  # compose network. Host publishing is handled by the compose mapping.
+  proxy:
+    port: ${ports_js_1.OATHKEEPER_PROXY_CONTAINER_PORT}
+  api:
+    port: ${ports_js_1.OATHKEEPER_API_CONTAINER_PORT}
+
+access_rules:
+  matching_strategy: regexp
+  repositories:
+    - file:///etc/config/oathkeeper/access-rules.yml
+
+errors:
+  fallback:
+    - json
+  handlers:
+    json:
+      enabled: true
+      config:
+        verbose: true
+
+authenticators:
+  oauth2_introspection:
+    enabled: true
+    config:
+      # Hydra admin introspection endpoint, reachable over the docker network.
+      # A valid (active) plugin access token → 200 and the read is forwarded to
+      # keto-read; a missing/invalid/inactive token → 401 at the proxy.
+      introspection_url: http://hydra:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT}/admin/oauth2/introspect
+  noop:
+    enabled: true
+
+authorizers:
+  allow:
+    enabled: true
+  deny:
+    enabled: true
+
+mutators:
+  noop:
+    enabled: true
+
+log:
+  level: debug
+  format: json
+`;
+}
+/**
+ * Oathkeeper access rule mirroring the hosted
+ * `ory-corp:cloud:keto:read:user-token` rule: token-introspect the caller,
+ * `allow`, and forward to keto-read with the `/user` prefix stripped. Scoped to
+ * the same read surface as hosted — `/user/relation-tuples*` and
+ * `/user/namespaces*` — on GET/HEAD/POST.
+ */
+function oathkeeperAccessRulesYaml() {
+    return `# Generated by @ory-agent-plugins — local development environment
+# Do not edit manually; re-run "local up" to regenerate.
+
+- id: ory-local:keto:read:user-token
+  match:
+    methods:
+      - GET
+      - HEAD
+      - POST
+    url: "http://<[^/]+>/user/<(relation-tuples|namespaces).*>"
+  authenticators:
+    - handler: oauth2_introspection
+  authorizer:
+    handler: allow
+  mutators:
+    - handler: noop
+  upstream:
+    url: http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT}
+    strip_path: /user
+    preserve_host: false
+`;
+}
 // ─── Nginx Gateway ─────────────────────────────────────────────────
 /**
  * Nginx config that acts as a unified API gateway, replicating what
  * Ory Network does: route all API paths to the correct backend service
  * so the @ory/client SDK works with a single basePath.
  */
-function nginxConf() {
+function nginxConf(oathkeeperEnabled = false) {
+    // The token-authenticated Keto read path (`/user/*`). Two shapes:
+    //   • default — a transparent passthrough: strip `/user` and forward straight
+    //     to keto-read. Matches the hosted *path shape* but enforces no auth.
+    //   • ORY_LOCAL_OATHKEEPER — forward the whole `/user/*` request (prefix
+    //     intact) to the Oathkeeper proxy, which introspects the OAuth2 access
+    //     token, then strips `/user` and forwards to keto-read itself. This
+    //     exercises the hosted token-introspection contract locally.
+    const userReadBlock = oathkeeperEnabled
+        ? `        # ── Keto read API (token-authenticated /user path) ────
+        # ORY_LOCAL_OATHKEEPER: front the /user/* read path with a real
+        # Oathkeeper proxy that introspects the plugin's OAuth2 access token
+        # (mirrors the hosted ory-corp:cloud:keto:read:user-token rule). The
+        # /user prefix is kept so Oathkeeper's access rule matches; Oathkeeper
+        # strips it before forwarding to keto-read. A missing/invalid token is
+        # rejected with 401 here instead of silently reaching Keto.
+        location /user/ {
+            proxy_pass http://oathkeeper:${ports_js_1.OATHKEEPER_PROXY_CONTAINER_PORT};
+        }`
+        : `        # ── Keto read API (token-authenticated /user path) ────
+        # ORY_LOCAL_OATHKEEPER=0 (opt-out): transparent passthrough. Strip /user
+        # and forward straight to keto-read with NO auth. Matches the hosted path
+        # shape only — token introspection is NOT exercised. The default (flag
+        # unset) fronts this path with a real Oathkeeper proxy instead.
+        location /user/relation-tuples {
+            rewrite ^/user(/.*)$ $1 break;
+            proxy_pass http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT};
+        }
+        location /user/namespaces {
+            rewrite ^/user(/.*)$ $1 break;
+            proxy_pass http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT};
+        }`;
     return `# Generated by @ory-agent-plugins — local development environment
 # Do not edit manually; re-run "local up" to regenerate.
 
@@ -575,62 +756,64 @@ http {
     proxy_set_header X-Forwarded-Proto $scheme;
 
     server {
-        listen 4000;
+        listen ${ports_js_1.GATEWAY_CONTAINER_PORT};
         server_name localhost;
 
         # ── Kratos public API ──────────────────────────────────
         # Sessions (FrontendApi.toSession → GET /sessions/whoami)
         location /sessions/ {
-            proxy_pass http://kratos:4433;
+            proxy_pass http://kratos:${ports_js_1.KRATOS_PUBLIC_CONTAINER_PORT};
         }
 
         # Self-service flows (login, registration, etc.)
         location /self-service/ {
-            proxy_pass http://kratos:4433;
+            proxy_pass http://kratos:${ports_js_1.KRATOS_PUBLIC_CONTAINER_PORT};
         }
 
         # ── Kratos admin API ──────────────────────────────────
         # Identity management
         location /admin/identities {
-            proxy_pass http://kratos:4434;
+            proxy_pass http://kratos:${ports_js_1.KRATOS_ADMIN_CONTAINER_PORT};
         }
 
         # ── Hydra admin API ───────────────────────────────────
         # Token introspection (OAuth2Api.introspectOAuth2Token → POST /admin/oauth2/introspect)
         location /admin/oauth2/ {
-            proxy_pass http://hydra:4445;
+            proxy_pass http://hydra:${ports_js_1.HYDRA_ADMIN_CONTAINER_PORT};
         }
 
         # ── Hydra public API ──────────────────────────────────
         location /oauth2/ {
-            proxy_pass http://hydra:4444;
+            proxy_pass http://hydra:${ports_js_1.HYDRA_PUBLIC_CONTAINER_PORT};
         }
 
         location /.well-known/ {
-            proxy_pass http://hydra:4444;
+            proxy_pass http://hydra:${ports_js_1.HYDRA_PUBLIC_CONTAINER_PORT};
         }
 
-        # ── Keto read API ─────────────────────────────────────
-        # Permission checks (PermissionApi.checkPermission → GET /relation-tuples/check/openapi)
-        # Batch checks (PermissionApi.batchCheckPermission → POST /relation-tuples/batch-check)
-        # No trailing slash on the location so a bare GET /relation-tuples
-        # (the listing endpoint) also matches and proxies through.
+${userReadBlock}
+
+        # ── Keto read API (legacy un-prefixed) ────────────────
+        # Retained for direct callers (the local seed step, curl, the Console).
+        # The plugin itself reads through the /user route above. No trailing
+        # slash on the location so a bare GET /relation-tuples matches.
         location /relation-tuples {
-            proxy_pass http://keto:4466;
+            proxy_pass http://keto:${ports_js_1.KETO_READ_CONTAINER_PORT};
         }
 
         # ── Keto write API ────────────────────────────────────
-        # RelationshipApi.createRelationship issues PUT /admin/relation-tuples
-        # (no trailing slash), and deleteRelationships issues DELETE on the
-        # same path with query params. The location must match both the
-        # slashless form and any sub-path; dropping the trailing slash on
-        # the nginx location does both.
+        # The plugin never writes here (permissions are provisioned in the Ory
+        # Console); this is for the local seed step and for hand-writing grants
+        # during a demo — PUT /admin/relation-tuples (no trailing slash) and
+        # DELETE on the same path with query params. The location must match
+        # both the slashless form and any sub-path; dropping the trailing slash
+        # on the nginx location does both.
         location /admin/relation-tuples {
-            proxy_pass http://keto:4467;
+            proxy_pass http://keto:${ports_js_1.KETO_WRITE_CONTAINER_PORT};
         }
 
         location /opl/ {
-            proxy_pass http://keto:4467;
+            proxy_pass http://keto:${ports_js_1.KETO_WRITE_CONTAINER_PORT};
         }
 
         # ── Gateway health ────────────────────────────────────
@@ -648,23 +831,47 @@ http {
 }
 `;
 }
-// ─── Default Ports ─────────────────────────────────────────────────
-exports.GATEWAY_PORT = 4000;
-exports.GATEWAY_URL = `http://localhost:${exports.GATEWAY_PORT}`;
-exports.CONSOLE_PORT = 4100;
-exports.CONSOLE_URL = `http://localhost:${exports.CONSOLE_PORT}`;
-exports.LOGIN_UI_PORT = 4455;
-exports.LOGIN_UI_URL = `http://localhost:${exports.LOGIN_UI_PORT}`;
-exports.KRATOS_PUBLIC_PORT = 4433;
-exports.KRATOS_ADMIN_PORT = 4434;
-exports.KETO_READ_PORT = 4466;
-exports.KETO_WRITE_PORT = 4467;
-exports.HYDRA_PUBLIC_PORT = 4444;
-exports.HYDRA_ADMIN_PORT = 4445;
-exports.JAEGER_UI_PORT = 16686;
-exports.JAEGER_OTLP_HTTP_PORT = 4318;
-exports.JAEGER_UI_URL = `http://localhost:${exports.JAEGER_UI_PORT}`;
-exports.JAEGER_OTLP_HTTP_URL = `http://localhost:${exports.JAEGER_OTLP_HTTP_PORT}`;
+// ─── Host ports and URLs ───────────────────────────────────────────
+//
+// Resolved once, at module load, from the environment — see `ports.ts` for the
+// override rules and for why container-internal ports are *not* part of this.
+// Module-load resolution keeps these as plain `const`s so every existing
+// consumer (and the public export surface in `index.ts`) is unchanged; the
+// process reads its environment at startup, which is when a CLI is configured.
+const { ports: LOCAL_PORTS, warnings: LOCAL_PORT_WARNINGS_INTERNAL } = (0, ports_js_1.resolveLocalPorts)();
+const { host: LOCAL_HOST, source: LOCAL_HOST_SOURCE } = (0, ports_js_1.resolveLocalHost)();
+/**
+ * Problems found while resolving ports (an unparseable value, an offset that
+ * runs off the end of the port range, two services pinned to one port). The
+ * manager prints these before starting so a typo'd override doesn't silently
+ * fall back to a default the user thought they had changed.
+ */
+exports.LOCAL_PORT_WARNINGS = LOCAL_PORT_WARNINGS_INTERNAL;
+/** The host every generated URL advertises, and where that value came from. */
+exports.LOCAL_STACK_HOST = LOCAL_HOST;
+exports.LOCAL_STACK_HOST_SOURCE = LOCAL_HOST_SOURCE;
+exports.GATEWAY_PORT = LOCAL_PORTS.gateway;
+exports.GATEWAY_URL = (0, ports_js_1.hostUrl)(LOCAL_HOST, exports.GATEWAY_PORT);
+exports.CONSOLE_PORT = LOCAL_PORTS.console;
+exports.CONSOLE_URL = (0, ports_js_1.hostUrl)(LOCAL_HOST, exports.CONSOLE_PORT);
+exports.LOGIN_UI_PORT = LOCAL_PORTS.loginUi;
+exports.LOGIN_UI_URL = (0, ports_js_1.hostUrl)(LOCAL_HOST, exports.LOGIN_UI_PORT);
+exports.KRATOS_PUBLIC_PORT = LOCAL_PORTS.kratosPublic;
+exports.KRATOS_ADMIN_PORT = LOCAL_PORTS.kratosAdmin;
+exports.KETO_READ_PORT = LOCAL_PORTS.ketoRead;
+exports.KETO_WRITE_PORT = LOCAL_PORTS.ketoWrite;
+exports.HYDRA_PUBLIC_PORT = LOCAL_PORTS.hydraPublic;
+exports.HYDRA_ADMIN_PORT = LOCAL_PORTS.hydraAdmin;
+exports.HYDRA_TOKEN_USER_PORT = LOCAL_PORTS.hydraTokenUser;
+/** Oathkeeper proxy port — the gateway forwards `/user/*` here when
+ * `ORY_LOCAL_OATHKEEPER` is set. Defaults clear of the login-UI port. */
+exports.OATHKEEPER_PROXY_PORT = LOCAL_PORTS.oathkeeperProxy;
+/** Oathkeeper API/rules port. */
+exports.OATHKEEPER_API_PORT = LOCAL_PORTS.oathkeeperApi;
+/** The resolved host-port set, for the preflight check and `local status`. */
+function getLocalPorts() {
+    return { ...LOCAL_PORTS };
+}
 /** URL the manager probes to confirm the gateway is healthy. */
 function gatewayHealthUrl() {
     return `${exports.GATEWAY_URL}${getGatewayConfig().healthPath}`;

package/dist/local/health.js

@@ -7,6 +7,7 @@ exports.checkAllServices = checkAllServices;
 exports.waitForSeedTargets = waitForSeedTargets;
 exports.waitForGateway = waitForGateway;
 const configs_js_1 = require("./configs.js");
+const ports_js_1 = require("./ports.js");
 async function checkEndpoint(name, url) {
     try {
         const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
@@ -32,10 +33,9 @@ async function checkAllServices(options = {}) {
     const gateway = options.gatewayUrl ?? (0, configs_js_1.gatewayHealthUrl)();
     const checks = [
         checkEndpoint("Gateway", gateway),
-        checkEndpoint("Kratos", `http://localhost:${configs_js_1.KRATOS_PUBLIC_PORT}/health/ready`),
-        checkEndpoint("Keto", `http://localhost:${configs_js_1.KETO_READ_PORT}/health/ready`),
-        checkEndpoint("Hydra", `http://localhost:${configs_js_1.HYDRA_PUBLIC_PORT}/health/ready`),
-        checkEndpoint("Jaeger", `http://localhost:${configs_js_1.JAEGER_UI_PORT}/`),
+        checkEndpoint("Kratos", `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.KRATOS_PUBLIC_PORT)}/health/ready`),
+        checkEndpoint("Keto", `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.KETO_READ_PORT)}/health/ready`),
+        checkEndpoint("Hydra", `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.HYDRA_PUBLIC_PORT)}/health/ready`),
     ];
     return Promise.all(checks);
 }
@@ -55,9 +55,9 @@ async function checkAllServices(options = {}) {
  */
 function seedTargetServices() {
     return [
-        { name: "Kratos", url: `http://localhost:${configs_js_1.KRATOS_ADMIN_PORT}/health/ready` },
-        { name: "Keto", url: `http://localhost:${configs_js_1.KETO_WRITE_PORT}/health/ready` },
-        { name: "Hydra", url: `http://localhost:${configs_js_1.HYDRA_ADMIN_PORT}/health/ready` },
+        { name: "Kratos", url: `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.KRATOS_ADMIN_PORT)}/health/ready` },
+        { name: "Keto", url: `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.KETO_WRITE_PORT)}/health/ready` },
+        { name: "Hydra", url: `${(0, ports_js_1.hostUrl)(configs_js_1.LOCAL_STACK_HOST, configs_js_1.HYDRA_ADMIN_PORT)}/health/ready` },
     ];
 }
 /**

package/dist/local/index.d.ts

@@ -2,5 +2,5 @@ export { runLocalCommand } from "./cli.js";
 export { localUp, localDown, localStatus, localSeed, localLogs, localReset, localEnv, localConfigure, ensureLocalOryStack, type EnsureLocalOryStackResult, } from "./manager.js";
 export { checkAllServices, waitForGateway, type ServiceHealth } from "./health.js";
 export { seedLocalEnvironment, USER_CLIENT_ID, USER_SUBJECT_NAMESPACE, type SeedResult, } from "./seed.js";
-export { GATEWAY_URL, GATEWAY_PORT, KRATOS_PUBLIC_PORT, KRATOS_ADMIN_PORT, KETO_READ_PORT, KETO_WRITE_PORT, HYDRA_PUBLIC_PORT, HYDRA_ADMIN_PORT, JAEGER_UI_PORT, JAEGER_OTLP_HTTP_PORT, JAEGER_UI_URL, JAEGER_OTLP_HTTP_URL, } from "./configs.js";
-export { ensureDevJaeger, stopDevJaeger, DEV_JAEGER_CONTAINER, DEV_JAEGER_IMAGE, type EnsureDevJaegerResult, type StopDevJaegerResult, } from "./jaeger.js";
+export { GATEWAY_URL, GATEWAY_PORT, KRATOS_PUBLIC_PORT, KRATOS_ADMIN_PORT, KETO_READ_PORT, KETO_WRITE_PORT, HYDRA_PUBLIC_PORT, HYDRA_ADMIN_PORT, HYDRA_TOKEN_USER_PORT, CONSOLE_PORT, CONSOLE_URL, LOGIN_UI_PORT, LOGIN_UI_URL, LOCAL_STACK_HOST, LOCAL_STACK_HOST_SOURCE, LOCAL_PORT_WARNINGS, getLocalPorts, } from "./configs.js";
+export { LOCAL_PORT_NAMES, LOCAL_PORT_SPECS, LOCAL_HOST_ENV_VAR, PORT_OFFSET_ENV_VAR, DEFAULT_LOCAL_HOST, resolveLocalPorts, resolveLocalHost, hostFromDockerHost, isLocalDockerDaemon, isPortAvailable, findPortConflicts, describePortConflicts, hostUrl, type LocalPortName, type ResolvedLocalPorts, type LocalHostSource, type PortConflict, } from "./ports.js";