@wardby/cli 0.1.0

package/dist/providers/jobs/kubernetes-client.js

@@ -0,0 +1,171 @@
+/**
+ * KubernetesApi over @kubernetes/client-node 2.x. A thin mapping: each seam
+ * method is one client call plus HTTP-status translation into the seam's
+ * error classes. Proven against a real cluster by kubernetes.integration.test.ts.
+ */
+import { ApiException, CoreV1Api, Exec, KubeConfig, NetworkingV1Api, VersionApi, } from "@kubernetes/client-node";
+import { Writable } from "node:stream";
+import { KubernetesAlreadyExistsError, KubernetesConflictError, KubernetesNotFoundError, } from "./kubernetes-api.js";
+function statusCode(error) {
+    return error instanceof ApiException ? error.code : undefined;
+}
+/** Undefined for a 404; rethrows anything else. */
+async function readOrUndefined(read) {
+    try {
+        return await read();
+    }
+    catch (error) {
+        if (statusCode(error) === 404)
+            return undefined;
+        throw error;
+    }
+}
+/** Swallows a 404 so deletes are idempotent. */
+async function deleteIgnoringMissing(remove) {
+    try {
+        await remove();
+    }
+    catch (error) {
+        if (statusCode(error) === 404)
+            return;
+        throw error;
+    }
+}
+async function create(what, write) {
+    try {
+        return await write();
+    }
+    catch (error) {
+        const code = statusCode(error);
+        if (code === 409)
+            throw new KubernetesAlreadyExistsError(what);
+        if (code === 404)
+            throw new KubernetesNotFoundError(what);
+        throw error;
+    }
+}
+async function replace(what, write) {
+    try {
+        return await write();
+    }
+    catch (error) {
+        const code = statusCode(error);
+        if (code === 409)
+            throw new KubernetesConflictError(what);
+        if (code === 404)
+            throw new KubernetesNotFoundError(what);
+        throw error;
+    }
+}
+/** Exit code from the exec status channel: "Success" is 0, else the ExitCode cause, else 1. */
+function exitCodeFromStatus(status) {
+    if (status.status === "Success")
+        return 0;
+    const cause = status.details?.causes?.find((c) => c.reason === "ExitCode");
+    const parsed = cause?.message === undefined ? Number.NaN : Number.parseInt(cause.message, 10);
+    return Number.isInteger(parsed) ? parsed : 1;
+}
+export class ClientNodeKubernetesApi {
+    config;
+    core;
+    networking;
+    version;
+    constructor(options = {}) {
+        this.config = new KubeConfig();
+        this.config.loadFromDefault();
+        if (options.context)
+            this.config.setCurrentContext(options.context);
+        this.core = this.config.makeApiClient(CoreV1Api);
+        this.networking = this.config.makeApiClient(NetworkingV1Api);
+        this.version = this.config.makeApiClient(VersionApi);
+    }
+    createConfigMap(namespace, body) {
+        return create(`configmap/${namespace}/${body.metadata?.name}`, () => this.core.createNamespacedConfigMap({ namespace, body }));
+    }
+    readConfigMap(namespace, name) {
+        return readOrUndefined(() => this.core.readNamespacedConfigMap({ namespace, name }));
+    }
+    replaceConfigMap(namespace, name, body) {
+        return replace(`configmap/${namespace}/${name}`, () => this.core.replaceNamespacedConfigMap({ namespace, name, body }));
+    }
+    createSecret(namespace, body) {
+        return create(`secret/${namespace}/${body.metadata?.name}`, () => this.core.createNamespacedSecret({ namespace, body }));
+    }
+    deleteSecret(namespace, name) {
+        return deleteIgnoringMissing(() => this.core.deleteNamespacedSecret({ namespace, name }));
+    }
+    createPod(namespace, body) {
+        return create(`pod/${namespace}/${body.metadata?.name}`, () => this.core.createNamespacedPod({ namespace, body }));
+    }
+    dryRunCreatePod(namespace, body) {
+        return create(`pod/${namespace}/${body.metadata?.name}?dryRun`, () => this.core.createNamespacedPod({ namespace, body, dryRun: "All" }));
+    }
+    readPod(namespace, name) {
+        return readOrUndefined(() => this.core.readNamespacedPod({ namespace, name }));
+    }
+    deletePod(namespace, name, gracePeriodSeconds) {
+        return deleteIgnoringMissing(() => this.core.deleteNamespacedPod({ namespace, name, gracePeriodSeconds }));
+    }
+    createNetworkPolicy(namespace, body) {
+        return create(`networkpolicy/${namespace}/${body.metadata?.name}`, () => this.networking.createNamespacedNetworkPolicy({ namespace, body }));
+    }
+    readNetworkPolicy(namespace, name) {
+        return readOrUndefined(() => this.networking.readNamespacedNetworkPolicy({ namespace, name }));
+    }
+    deleteNetworkPolicy(namespace, name) {
+        return deleteIgnoringMissing(() => this.networking.deleteNamespacedNetworkPolicy({ namespace, name }));
+    }
+    readService(namespace, name) {
+        return readOrUndefined(() => this.core.readNamespacedService({ namespace, name }));
+    }
+    readEndpoints(namespace, name) {
+        return readOrUndefined(() => this.core.readNamespacedEndpoints({ namespace, name }));
+    }
+    async readApiServerVersion() {
+        return (await this.version.getCode()).gitVersion;
+    }
+    async readNamespace(name) {
+        return (await readOrUndefined(() => this.core.readNamespace({ name }))) !== undefined;
+    }
+    exec(namespace, pod, container, command, options) {
+        // stderr is requested but discarded so it never reaches wardby's logs.
+        const stderr = new Writable({
+            write(_chunk, _encoding, callback) {
+                callback();
+            },
+        });
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            let socket;
+            const settle = (outcome) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                outcome();
+            };
+            const timer = setTimeout(() => {
+                settle(() => reject(new Error("kubernetes_exec_timeout")));
+                socket?.close();
+            }, options.timeoutMs);
+            new Exec(this.config)
+                .exec(namespace, pod, container, command, options.stdout ?? null, stderr, options.stdin ?? null, false, (status) => settle(() => resolve(exitCodeFromStatus(status))))
+                .then((ws) => {
+                socket = ws;
+                // Timed out while still connecting: close the late socket.
+                if (settled) {
+                    socket.close();
+                    return;
+                }
+                // The status callback fires before the library closes the socket, so a close
+                // that arrives first means the command's exit status was never reported.
+                socket.addEventListener("close", () => settle(() => reject(new Error("kubernetes_exec_closed_without_status"))));
+            }, 
+            // A failed WebSocket handshake rejects with a ws ErrorEvent, not an Error.
+            (error) => settle(() => reject(error instanceof Error ? error : new Error("kubernetes_exec_connect_failed", { cause: error }))));
+        });
+    }
+    readLogTail(namespace, pod, container, tailLines, limitBytes) {
+        return this.core.readNamespacedPodLog({ namespace, name: pod, container, tailLines, limitBytes });
+    }
+}

package/dist/providers/jobs/kubernetes-dry-run-fixture.d.ts

@@ -0,0 +1,49 @@
+import type { KubernetesPlatform } from "./kubernetes-platform.js";
+export interface PodMutation {
+    op: "add" | "replace" | "remove";
+    /** JSON Pointer (RFC 6901): "/" separated, with ~1 for "/" and ~0 for "~". */
+    path: string;
+    value?: unknown;
+}
+export interface DryRunFixture {
+    capturedAt: string;
+    platform: KubernetesPlatform;
+    /** True until a real server-side dry run replaces this file. */
+    provisional: boolean;
+    source: string;
+    notes: string[];
+    mutations: PodMutation[];
+}
+export declare function loadDryRunFixture(): DryRunFixture;
+/**
+ * Returns a copy of `document` with every mutation applied in order.
+ *
+ * `add` and `replace` assign at the pointer. `remove` deletes an object key,
+ * but SPLICES an array element: `delete array[2]` would leave a hole that
+ * serializes back as `null`, which would then be deep-compared against a real
+ * pod as a null list entry rather than as a removal. The differ only ever
+ * replaces arrays wholesale, so an array pointer can reach here only from a
+ * hand-written fixture entry — which is exactly when a silent `null` hole
+ * would be hardest to spot in review.
+ */
+export declare function applyMutations<T>(document: T, mutations: readonly PodMutation[]): T;
+/**
+ * The mutations that turn `before` into `after`. Objects are walked key by key;
+ * anything else (including arrays) is replaced wholesale, which keeps a
+ * toleration list or a container list readable as one op.
+ *
+ * The equality check for that wholesale case goes through `canonical()` (recursive key
+ * sort), not a raw `JSON.stringify`: a captured pod's nested objects come back from a real
+ * API server with different key insertion order than `buildRunPod`'s own literals even when
+ * every value is identical, and a raw string compare would misread that as a genuine change —
+ * replacing an entire container or volume list with an opaque, unreviewable blob that a real
+ * platform rewrite could hide inside just as easily. `canonical()` makes the comparison see
+ * only actual value differences, while still emitting one "replace" op per array so the fixture
+ * stays readable.
+ *
+ * Sorted by code point, not `localeCompare`: the result is committed to a file
+ * and reviewed as a diff, so the order must not depend on the capturing
+ * machine's locale (an ICU collation folds case together and orders
+ * `/spec/Foo` and `/spec/foo` by tie-break rules that differ between hosts).
+ */
+export declare function diffMutations(before: unknown, after: unknown, prefix?: string): PodMutation[];

package/dist/providers/jobs/kubernetes-dry-run-fixture.js

@@ -0,0 +1,141 @@
+/**
+ * The recorded Autopilot admission mutations, and the two pure functions that
+ * produce and replay them.
+ *
+ * The fixture stores a *mutation list*, not a pair of whole pods, for two
+ * reasons: a reviewer can read the entire set of differences the platform
+ * introduces in a few lines, and the test rebuilds the submitted pod from the
+ * live builder rather than replaying a stored one, so the fixture can never
+ * carry a stale *pod*.
+ *
+ * That is a narrower guarantee than it sounds, and the difference matters.
+ * Because the attestation test derives BOTH operands from the same builder, it
+ * is structurally blind to a weakening of the builder itself: measured on this
+ * branch, setting `automountServiceAccountToken: true` or halving the worker's
+ * CPU leaves the whole suite green. Three other sabotages — dropping
+ * `runtimeClassName`, dropping the pod `seccompProfile`, `hostPID: true` — do
+ * fail it, but only incidentally: those exact fields appear in the "rejects one
+ * more mutation" tamper list, so a builder that already emits the tampered
+ * value turns that tamper into a no-op. That is luck, not coverage, and it is
+ * not a property to rely on.
+ *
+ * What this file guards is that the *platform's* mutation set is still exactly
+ * the set the profile forgives. The builder's own fields are guarded by
+ * kubernetes-isolation.test.ts and kubernetes-platform.test.ts, and must stay
+ * that way.
+ *
+ * `provisional` is true while the file is written from documentation rather
+ * than captured from a cluster. The attestation suite names that state in its
+ * report, so a forgotten capture cannot pass unnoticed.
+ *
+ * This is development data reviewed in a diff, never a runtime authority: the
+ * launcher never asks a cluster what it is allowed to change.
+ */
+import { readFileSync } from "node:fs";
+import { canonical } from "./kubernetes-isolation.js";
+const FIXTURE_URL = new URL("./fixtures/gke-autopilot-dry-run.json", import.meta.url);
+export function loadDryRunFixture() {
+    return JSON.parse(readFileSync(FIXTURE_URL, "utf8"));
+}
+function segments(path) {
+    if (path === "" || !path.startsWith("/"))
+        throw new Error(`dry_run_fixture_path: ${path}`);
+    return path
+        .slice(1)
+        .split("/")
+        .map((segment) => segment.replaceAll("~1", "/").replaceAll("~0", "~"));
+}
+function container(root, path) {
+    let node = root;
+    for (const key of path) {
+        if (node === null || typeof node !== "object")
+            throw new Error(`dry_run_fixture_path: /${path.join("/")}`);
+        node = node[key];
+    }
+    if (node === null || typeof node !== "object")
+        throw new Error(`dry_run_fixture_path: /${path.join("/")}`);
+    return node;
+}
+/**
+ * Returns a copy of `document` with every mutation applied in order.
+ *
+ * `add` and `replace` assign at the pointer. `remove` deletes an object key,
+ * but SPLICES an array element: `delete array[2]` would leave a hole that
+ * serializes back as `null`, which would then be deep-compared against a real
+ * pod as a null list entry rather than as a removal. The differ only ever
+ * replaces arrays wholesale, so an array pointer can reach here only from a
+ * hand-written fixture entry — which is exactly when a silent `null` hole
+ * would be hardest to spot in review.
+ */
+export function applyMutations(document, mutations) {
+    const copy = structuredClone(document);
+    for (const mutation of mutations) {
+        const path = segments(mutation.path);
+        // `segments` always yields at least one element for a pointer starting with "/", so this
+        // never throws in practice; it narrows the type without a non-null assertion.
+        const key = path.pop();
+        if (key === undefined)
+            throw new Error(`dry_run_fixture_path: ${mutation.path}`);
+        const parent = container(copy, path);
+        if (Array.isArray(parent) && mutation.op === "remove") {
+            const index = /^(0|[1-9][0-9]*)$/.test(key) ? Number(key) : -1;
+            if (index < 0 || index >= parent.length)
+                throw new Error(`dry_run_fixture_path: ${mutation.path}`);
+            parent.splice(index, 1);
+            continue;
+        }
+        const bag = parent;
+        if (mutation.op === "remove")
+            delete bag[key];
+        else
+            bag[key] = structuredClone(mutation.value);
+    }
+    return copy;
+}
+function escape(key) {
+    return key.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+/**
+ * The mutations that turn `before` into `after`. Objects are walked key by key;
+ * anything else (including arrays) is replaced wholesale, which keeps a
+ * toleration list or a container list readable as one op.
+ *
+ * The equality check for that wholesale case goes through `canonical()` (recursive key
+ * sort), not a raw `JSON.stringify`: a captured pod's nested objects come back from a real
+ * API server with different key insertion order than `buildRunPod`'s own literals even when
+ * every value is identical, and a raw string compare would misread that as a genuine change —
+ * replacing an entire container or volume list with an opaque, unreviewable blob that a real
+ * platform rewrite could hide inside just as easily. `canonical()` makes the comparison see
+ * only actual value differences, while still emitting one "replace" op per array so the fixture
+ * stays readable.
+ *
+ * Sorted by code point, not `localeCompare`: the result is committed to a file
+ * and reviewed as a diff, so the order must not depend on the capturing
+ * machine's locale (an ICU collation folds case together and orders
+ * `/spec/Foo` and `/spec/foo` by tie-break rules that differ between hosts).
+ */
+export function diffMutations(before, after, prefix = "") {
+    const plain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+    if (!plain(before) || !plain(after)) {
+        return JSON.stringify(canonical(before)) === JSON.stringify(canonical(after))
+            ? []
+            : [{ op: "replace", path: prefix, value: after }];
+    }
+    const left = before;
+    const right = after;
+    const mutations = [];
+    for (const key of new Set([...Object.keys(left), ...Object.keys(right)])) {
+        const path = `${prefix}/${escape(key)}`;
+        if (!(key in right) || right[key] === undefined) {
+            if (left[key] !== undefined)
+                mutations.push({ op: "remove", path });
+        }
+        else if (!(key in left) || left[key] === undefined) {
+            mutations.push({ op: "add", path, value: right[key] });
+        }
+        else {
+            mutations.push(...diffMutations(left[key], right[key], path));
+        }
+    }
+    return mutations.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}

package/dist/providers/jobs/kubernetes-isolation.d.ts

@@ -0,0 +1,147 @@
+import type { V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
+import type { JobSpec } from "./types.js";
+import { type KubernetesPlatform } from "./kubernetes-platform.js";
+export declare const KUBERNETES_ISOLATION_ERROR = "kubernetes_isolation_unsupported";
+export declare const KUBERNETES_PROVIDER_UNSUPPORTED = "kubernetes_provider_unsupported";
+/** Extra seconds past timeoutSec before Kubernetes kills the pod (keeper included). */
+export declare const POD_DEADLINE_GRACE_SECONDS = 300;
+export declare const KEEPER_CONTAINER = "keeper";
+export declare const STORAGE_INIT_CONTAINER = "storage-init";
+export declare const WORKER_CONTAINER = "worker";
+export declare const STORAGE_ROOT = "/run/wardby/storage";
+export declare const KEEPER_SEEDED_MARKER = "/run/wardby/storage/input/.seeded";
+export declare const PROXY_POD_LABEL: {
+    readonly "app.kubernetes.io/name": "wardby-coding-proxy";
+};
+/**
+ * What every run pod carries and what the proxy's own ingress rule must admit on the deny port.
+ * Single source: `runLabels` stamps it, `readProxyWitness` checks the proxy admits it.
+ */
+export declare const RUN_COMPONENT_LABEL: {
+    readonly "wardby.io/component": "coding-run";
+};
+/** The probe proved enforcement: the proxy port connected and the deny port was blocked. */
+export declare const ENFORCEMENT_PROBE_PROVEN = 0;
+/** The deny port was reachable: no policy is blocking it, or the policy is not port-scoped. */
+export declare const ENFORCEMENT_PROBE_DENY_REACHABLE = 3;
+/** The proxy port itself was unreachable: nothing could be witnessed (proxy down, or only the namespace default-deny is programmed). */
+export declare const ENFORCEMENT_PROBE_PROXY_UNREACHABLE = 4;
+/**
+ * The deny port answered with an RST: the SYN reached the destination host, so nothing is
+ * blocking the path — the port is reachable-but-unserved and witnesses nothing.
+ */
+export declare const ENFORCEMENT_PROBE_DENY_REFUSED = 5;
+export interface KubernetesRunNames {
+    token: string;
+    runSha: string;
+    pod: string;
+    policy: string;
+    record: string;
+    secret: string;
+}
+/**
+ * The per-run object names for a run token. The only place the naming scheme lives: the launcher
+ * resolves a handle's token through this, so names can never drift between creation and cleanup.
+ */
+export declare function kubernetesRunNamesForToken(token: string): Omit<KubernetesRunNames, "runSha">;
+export declare function kubernetesRunNames(runId: string): KubernetesRunNames;
+export declare function runLabels(runId: string): Record<string, string>;
+/** Same grammar as Docker's repository digests; a cluster cannot pull a bare local image ID. */
+export declare function isRegistryDigest(image: string): boolean;
+export declare function validateKubernetesSpec(spec: JobSpec): void;
+export interface RunPodOptions {
+    namespace: string;
+    proxyIp: string;
+    runtimeClassName?: string;
+    /** Which platform's admission rules the emitted resources must already satisfy. Default: "generic". */
+    platform?: KubernetesPlatform;
+}
+export declare function buildRunPod(spec: JobSpec, options: RunPodOptions): V1Pod;
+export declare function buildRunNetworkPolicy(spec: JobSpec, namespace: string): V1NetworkPolicy;
+export declare function buildCapabilitySecret(spec: JobSpec, namespace: string, capability: string): V1Secret;
+/**
+ * A copy of `pod` with ONLY the API server's own defaulting and aliasing undone
+ * — the same `normalizeSpec` pass `assertRunPodMatches` runs, and nothing else.
+ *
+ * Exported for src/tools/capture-fixture.ts, which runs it over both the
+ * submitted and the returned pod before diffing them. Without it the diff is
+ * dominated by fields every API server fills in on every create
+ * (schedulerName, priority, terminationMessagePath on each container, probe
+ * defaults, `2048Mi` requantized to `2Gi`, ...); because the differ replaces
+ * arrays wholesale those collapse into opaque `replace /spec/containers`
+ * blobs, and a genuine platform rewrite *inside* a container would be
+ * indistinguishable from the noise.
+ *
+ * It deliberately does NOT apply `normalizePlatformMetadata`: that deletes
+ * exactly the platform-injected keys a capture exists to record. Fails closed
+ * (throws) on a spec the normalizer cannot make sense of.
+ */
+export declare function undoApiServerDefaults(pod: V1Pod): V1Pod;
+/**
+ * Recursively sorts object keys and drops `undefined` values so key order and API-omitted
+ * fields never matter; array order is preserved.
+ *
+ * Exported for kubernetes-dry-run-fixture.ts's `diffMutations`: a captured pod's nested objects
+ * (container resource requests, volume definitions, host aliases, ...) come back from a real
+ * cluster with different key insertion order than `buildRunPod`'s own object literals, even when
+ * every value is identical. Without canonicalizing first, `diffMutations`' array branch treats
+ * that key-order difference as a genuine change and replaces the WHOLE array (every container,
+ * every volume) with an opaque blob — exactly the failure mode its own doc comment warns a real
+ * platform rewrite could hide inside. `assertRunPodMatches` below is unaffected by this (it
+ * already canonicalizes before comparing); only the capture tool's mutation list was at risk.
+ */
+export declare function canonical(value: unknown): unknown;
+/**
+ * Deep-compares the pod the API server read back against the pod wardby built.
+ * ANY surviving difference fails the run closed.
+ *
+ * `platform` defaults to "generic" on purpose: a caller that forgets it gets the
+ * strictest behaviour, never the most permissive. A profile can only narrow what
+ * counts as an expected difference (by deleting named keys from both operands);
+ * it can never disable or short-circuit the comparison.
+ */
+export declare function assertRunPodMatches(actual: V1Pod, expected: V1Pod, platform?: KubernetesPlatform): void;
+export declare function assertRunNetworkPolicyMatches(actual: V1NetworkPolicy, expected: V1NetworkPolicy): void;
+/**
+ * A `node -e` script (argv only, never a shell) that measures BOTH of the proxy's
+ * ports in one pass, with a 3 s connect timeout each (above Linux's 1 s initial
+ * SYN retransmission, so one dropped SYN on an allowed path still connects).
+ *
+ * Measuring both is what makes the result decisive. A NetworkPolicy denial drops
+ * the packet rather than rejecting it — GKE Dataplane V2, which Autopilot runs,
+ * always drops — so "the deny port did not answer" is equally consistent with
+ * "the proxy is gone and no policy exists at all". Requiring the proxy port to
+ * connect in the *same* probe turns "something is listening" from a control-plane
+ * inference into a fact this pod just observed.
+ *
+ * That pairing alone is still not enough, and this was reproduced on a live
+ * cluster: in a namespace with NO NetworkPolicy at all, against a pod listening
+ * on 8787 and serving nothing on 8788, a probe that collapsed `error` and
+ * `timeout` into one "not reachable" exited PROVEN while it had full internet
+ * egress. The pairing only rules out "the whole proxy pod is dead"; whenever the
+ * deny *listener specifically* is unserved, "blocked" and "nothing there" are
+ * the same observation. No control-plane read fixes this — Endpoints subset
+ * ports come from the Service's numeric targetPort, not from anything actually
+ * binding — so the distinction has to be made in the dataplane, here:
+ *
+ * - deny port **times out** → the packet was dropped somewhere on the path → the only outcome
+ *   that can prove a policy. Note what it does NOT prove on its own: *which* hop dropped it. That
+ *   it was the run pod's own egress policy follows from the proxy admitting run pods on the deny
+ *   port at its own ingress, leaving no other hop that would drop it — a precondition the
+ *   preflight's `proxy-service` check now verifies (readProxyWitness), after a live cluster
+ *   falsified the assumption: with the drop moved to the destination, a prober holding no policy
+ *   at all and with full internet egress read PROVEN.
+ * - deny port **refused** (RST / ECONNREFUSED) → the SYN reached the destination host, so
+ *   nothing blocked the path. This holds on every dataplane, drop-based ones included, because
+ *   a drop cannot produce an RST. Reported as ENFORCEMENT_PROBE_DENY_REFUSED, never as proven.
+ * - proxy port must still CONNECT for anything to count at all.
+ *
+ * Consequence, intended: on a **reject-style** CNI a genuine policy denial also arrives as an
+ * RST, so such a cluster now fails closed here rather than passing vacuously. Failing closed on
+ * a cluster whose refusals are ambiguous is the correct direction — a witness that cannot tell
+ * "denied" from "unserved" is not a witness — and such a cluster needs a different one.
+ *
+ * Exit codes are ENFORCEMENT_PROBE_PROVEN / _DENY_REACHABLE / _PROXY_UNREACHABLE / _DENY_REFUSED.
+ * The IP is validated and embedded as a JSON string literal.
+ */
+export declare function enforcementProbeScript(proxyIp: string): string;