/**
 * Ory service configuration templates for local development.
 *
 * Each function returns the file content as a string. The local manager
 * writes these into .ory-dev/ory/ at runtime so Docker Compose can mount them.
 */
import { type ResolvedLocalPorts } from "./ports.js";
export type ConsoleSource = "env" | "default";
export interface GatewayConfig {
    /** Path under GATEWAY_URL that returns 2xx when the gateway is ready. */
    healthPath: string;
}
export interface ConsoleConfig {
    /** True when Console Lite source is available and the UI will be built. */
    enabled: boolean;
    /**
     * Build context for `docker compose build` (Console Lite only). This is the
     * cloud **monorepo root**, not the console app dir — the Dockerfile copies
     * workspace files (`package.json`, `sdk/packages`, `console/console`, …)
     * from the context root.
     */
    buildContext?: string;
    /**
     * Dockerfile path relative to buildContext (Console Lite only). Because the
     * build context is the monorepo root, this is `console/console/<Dockerfile>`.
     */
    dockerfile?: string;
    /**
     * Absolute path to the `elements` workspace, passed to docker as a named
     * build context. Console Lite's Dockerfile uses `COPY --from=elements`.
     */
    elementsContext?: string;
    /**
     * Value for the Console Lite Dockerfile's `NEXT_PUBLIC_BUILD_MODE`
     * build arg. Defaults to `oss`.
     */
    buildMode?: string;
    /** Where the Console Lite path came from. */
    source?: ConsoleSource;
}
/** Default location of the Console Lite source tree, sibling-checkout layout. */
export declare const DEFAULT_CONSOLE_LITE_SUBPATH: string;
/**
 * The API gateway is always the bundled nginx routing layer that
 * proxies bare Ory paths to Kratos / Hydra / Keto. No mode choice.
 */
export declare function getGatewayConfig(): GatewayConfig;
/**
 * Resolve whether the optional Console Lite UI service should be brought
 * up, and if so, with what build inputs.
 *
 * Enabled when Console Lite source is present at
 * `<repoRoot>/../cloud/console/console` (sibling checkout, where
 * `repoRoot` is the outermost `.git` ancestor of the given `projectRoot`).
 * Disabled when that path is missing or unreadable.
 *
 * `ORY_CONSOLE_LITE_PATH` is an explicit override pointing at the console app
 * source tree (`<monorepo>/console/console`). When set it must point at a
 * usable tree; downstream validation surfaces a hard error if the derived
 * build context or Dockerfile doesn't exist. Relative paths are resolved
 * against pnpm's `INIT_CWD` so they match the user's shell cwd.
 *
 * In all cases the docker build context is the console app tree's **monorepo
 * root** (two levels up) — see {@link monorepoRootForConsoleApp}.
 */
export declare function getConsoleConfig(projectRoot?: string): ConsoleConfig;
export interface OathkeeperConfig {
    /** Whether to front the Keto `/user/*` read path with Oathkeeper. */
    enabled: boolean;
}
/**
 * Resolve whether the local stack should front Keto's token-authenticated
 * `/user/*` read path with a real **Oathkeeper** service.
 *
 * **On by default** so the local stack mirrors the hosted token-introspection
 * contract: an Oathkeeper service configured like the hosted
 * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
 * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
 * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
 * read permissions locally, exactly as it is on a hosted Ory project. (The
 * plugin's agent DCR / user PKCE tokens are populated before any permission read
 * runs, so this is transparent in the normal flow.)
 *
 * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
 * to a transparent nginx passthrough that strips `/user` and forwards straight to
 * keto-read with **no** auth — a leaner stack that matches the hosted *path shape*
 * only, useful when iterating on something unrelated to the auth layer.
 */
export declare function getOathkeeperConfig(): OathkeeperConfig;
/**
 * Render the docker-compose YAML.
 *
 * `consoleCfg` controls whether the optional Console UI service is
 * emitted. When omitted, it is resolved via `getConsoleConfig(projectRoot)`.
 * The nginx API gateway and the login UI are always emitted.
 */
export declare function dockerComposeYaml(projectRoot?: string, consoleCfg?: ConsoleConfig, oathkeeperCfg?: OathkeeperConfig): string;
export declare function kratosConfigYaml(): string;
export declare function kratosIdentitySchema(): string;
export declare function ketoConfigYaml(): string;
export declare function hydraConfigYaml(): string;
/**
 * Oathkeeper server config. Only written when `ORY_LOCAL_OATHKEEPER` is set.
 *
 * Serves the proxy (the gateway forwards `/user/*` here) and the API port, and
 * declares the handlers the access rule references: the `oauth2_introspection`
 * authenticator introspects the plugin's OAuth2 access token against Hydra's
 * admin introspection endpoint, `allow` authorizes, and `noop` mutates. Rules
 * use the `regexp` matching strategy so the `/user/*` URL pattern resolves.
 */
export declare function oathkeeperConfigYaml(): string;
/**
 * Oathkeeper access rule mirroring the hosted
 * `ory-corp:cloud:keto:read:user-token` rule: token-introspect the caller,
 * `allow`, and forward to keto-read with the `/user` prefix stripped. Scoped to
 * the same read surface as hosted — `/user/relation-tuples*` and
 * `/user/namespaces*` — on GET/HEAD/POST.
 */
export declare function oathkeeperAccessRulesYaml(): string;
/**
 * Nginx config that acts as a unified API gateway, replicating what
 * Ory Network does: route all API paths to the correct backend service
 * so the @ory/client SDK works with a single basePath.
 */
export declare function nginxConf(oathkeeperEnabled?: boolean): string;
/**
 * Problems found while resolving ports (an unparseable value, an offset that
 * runs off the end of the port range, two services pinned to one port). The
 * manager prints these before starting so a typo'd override doesn't silently
 * fall back to a default the user thought they had changed.
 */
export declare const LOCAL_PORT_WARNINGS: readonly string[];
/** The host every generated URL advertises, and where that value came from. */
export declare const LOCAL_STACK_HOST: string;
export declare const LOCAL_STACK_HOST_SOURCE: import("./ports.js").LocalHostSource;
export declare const GATEWAY_PORT: number;
export declare const GATEWAY_URL: string;
export declare const CONSOLE_PORT: number;
export declare const CONSOLE_URL: string;
export declare const LOGIN_UI_PORT: number;
export declare const LOGIN_UI_URL: string;
export declare const KRATOS_PUBLIC_PORT: number;
export declare const KRATOS_ADMIN_PORT: number;
export declare const KETO_READ_PORT: number;
export declare const KETO_WRITE_PORT: number;
export declare const HYDRA_PUBLIC_PORT: number;
export declare const HYDRA_ADMIN_PORT: number;
export declare const HYDRA_TOKEN_USER_PORT: number;
/** Oathkeeper proxy port — the gateway forwards `/user/*` here when
 * `ORY_LOCAL_OATHKEEPER` is set. Defaults clear of the login-UI port. */
export declare const OATHKEEPER_PROXY_PORT: number;
/** Oathkeeper API/rules port. */
export declare const OATHKEEPER_API_PORT: number;
/** The resolved host-port set, for the preflight check and `local status`. */
export declare function getLocalPorts(): ResolvedLocalPorts;
/** URL the manager probes to confirm the gateway is healthy. */
export declare function gatewayHealthUrl(): string;