@wardby/cli 0.5.3 → 0.6.0

package/dist/native-worker/gateway.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The trusted side of the native sandbox worker contract. `runSandboxedEngine`
+ * is an Engine in all but name: the runner hands it the same context it would
+ * hand NativeEngine, and it returns an EngineResult — but the turn loop runs
+ * in a worker, and this module serves the worker's calls from that context.
+ *
+ * Authority stays here (invariant 8 of the plan): model usage and cost are
+ * metered from what the provider streamed through this gateway, never taken
+ * from the worker; every call is validated against the protocol schemas and
+ * refused once the run is no longer drivable; built-in tools and privileged
+ * sandbox bridges are served only by name from the run's own surface.
+ */
+import type { EngineResult, EngineRunContext } from "../providers/engine/types.js";
+import type { LlmStreamEvent } from "../providers/llm/types.js";
+import { type PrivilegedHost } from "../sandbox/host-functions.js";
+import { type WorkerInput } from "./protocol.js";
+/** The trusted gateway as a transport sees it: untrusted requests in, results or GatewayErrors out. */
+export interface NativeGateway {
+    call(request: unknown): Promise<unknown>;
+    stream(request: unknown): AsyncIterable<LlmStreamEvent>;
+}
+/** Starts a worker for `input`, lets it call `gateway`, and resolves when it exits. */
+export interface WorkerLauncher {
+    run(input: WorkerInput, gateway: NativeGateway, signal: AbortSignal): Promise<{
+        exitCode: number | null;
+    }>;
+}
+/** Where a run stands, read live on every call. */
+export type RunDrivability = "drivable" | "cancelled" | "ended";
+/** Thrown when the worker stopped because the run was cancelled; the runner records `cancelled`. */
+export declare class SandboxRunCancelledError extends Error {
+}
+export interface SandboxedEngineOptions {
+    runId: string;
+    input: WorkerInput;
+    /** The context the runner would hand NativeEngine: the run-bound LLM, onText, and onProgress. */
+    ctx: Pick<EngineRunContext, "providers" | "onText" | "onProgress">;
+    builtinHandler: (name: string) => ((argsJson: string) => Promise<string>) | undefined;
+    privilegedHostFor: (tool: string, signal: AbortSignal) => PrivilegedHost | undefined;
+    drivability: () => Promise<RunDrivability>;
+    launcher: WorkerLauncher;
+}
+/** Runs one native run's engine in a worker and returns its result with gateway-metered usage. */
+export declare function runSandboxedEngine(options: SandboxedEngineOptions): Promise<EngineResult>;

package/dist/native-worker/gateway.js

@@ -0,0 +1,197 @@
+/**
+ * The trusted side of the native sandbox worker contract. `runSandboxedEngine`
+ * is an Engine in all but name: the runner hands it the same context it would
+ * hand NativeEngine, and it returns an EngineResult — but the turn loop runs
+ * in a worker, and this module serves the worker's calls from that context.
+ *
+ * Authority stays here (invariant 8 of the plan): model usage and cost are
+ * metered from what the provider streamed through this gateway, never taken
+ * from the worker; every call is validated against the protocol schemas and
+ * refused once the run is no longer drivable; built-in tools and privileged
+ * sandbox bridges are served only by name from the run's own surface.
+ */
+import { isPrivilegedBridgeName } from "../sandbox/host-functions.js";
+import { logger } from "../core/logger.js";
+import { GatewayError, GatewayRequestSchema, NATIVE_WORKER_PROTOCOL_VERSION, parseParams, ProtocolError, } from "./protocol.js";
+const gatewayLog = logger.child({ module: "native-gateway" });
+/** Thrown when the worker stopped because the run was cancelled; the runner records `cancelled`. */
+export class SandboxRunCancelledError extends Error {
+}
+/** Runs one native run's engine in a worker and returns its result with gateway-metered usage. */
+export async function runSandboxedEngine(options) {
+    const { runId, input, ctx } = options;
+    const llm = ctx.providers.llm;
+    const controller = new AbortController();
+    const usage = { tokensIn: 0, tokensOut: 0, costUsd: 0, cachedInputTokens: 0, cacheWriteTokens: 0 };
+    const usedCallIds = new Set();
+    const builtinResults = new Map();
+    const hosts = new Map();
+    let lastTextSeq = -1;
+    let finished;
+    let cancelled = false;
+    const meter = (event) => {
+        usage.tokensIn += event.inputTokens;
+        usage.tokensOut += event.outputTokens;
+        usage.costUsd += event.costUsd;
+        usage.cachedInputTokens += event.cachedInputTokens ?? 0;
+        usage.cacheWriteTokens += event.cacheWriteTokens ?? 0;
+    };
+    /** Validates the envelope and the run, and claims the callId; returns the method's params. */
+    const admit = async (raw, expected) => {
+        const parsed = GatewayRequestSchema.safeParse(raw);
+        if (!parsed.success) {
+            const v = raw?.v;
+            if (v !== undefined && v !== NATIVE_WORKER_PROTOCOL_VERSION) {
+                throw new GatewayError("invalid_request", new ProtocolError("unsupported_protocol_version").message);
+            }
+            throw new GatewayError("invalid_request", parsed.error.issues[0]?.message ?? "invalid request");
+        }
+        const request = parsed.data;
+        if (request.runId !== runId)
+            throw new GatewayError("not_allowed", "request for another run");
+        if (expected && request.method !== expected)
+            throw new GatewayError("invalid_request", "wrong method");
+        let params;
+        try {
+            params = parseParams(request.method, request.params);
+        }
+        catch (err) {
+            throw new GatewayError("invalid_request", err instanceof Error ? err.message : String(err));
+        }
+        const state = await options.drivability();
+        if (state !== "drivable") {
+            if (state === "cancelled")
+                cancelled = true;
+            controller.abort();
+            throw new GatewayError("run_not_drivable", "This run is no longer running.");
+        }
+        return { request, params };
+    };
+    const claim = (callId) => {
+        if (usedCallIds.has(callId))
+            throw new GatewayError("duplicate_call", `callId "${callId}" was already used.`);
+        usedCallIds.add(callId);
+    };
+    const gateway = {
+        async *stream(raw) {
+            const { request, params } = await admit(raw, "llm.stream");
+            claim(request.callId);
+            // The worker may only call the run's own pinned model.
+            if (params.request.model !== input.agent.model) {
+                throw new GatewayError("not_allowed", "A run may only call its own model.");
+            }
+            const req = params.request;
+            let sawDone = false;
+            let streamedText = "";
+            try {
+                for await (const event of llm.stream(req, controller.signal)) {
+                    if (event.type === "done") {
+                        sawDone = true;
+                        meter(event.usage);
+                    }
+                    else if (event.type === "text") {
+                        streamedText += event.delta;
+                    }
+                    yield event;
+                }
+            }
+            finally {
+                // The worker stopped reading (its own mid-stream budget cutoff, or it went away) before the
+                // provider reported usage: bill this gateway's own estimate of what was streamed, so an
+                // aborted call is never free.
+                if (!sawDone) {
+                    const inputTokens = await llm.countTokens(req.model, req.messages, req.tools).catch(() => 0);
+                    const outputTokens = streamedText
+                        ? await llm.countTokens(req.model, [{ role: "assistant", content: streamedText }]).catch(() => 0)
+                        : 0;
+                    meter({ inputTokens, outputTokens, costUsd: llm.priceUsd(req.model, { inputTokens, outputTokens }) });
+                }
+            }
+        },
+        async call(raw) {
+            const { request, params } = await admit(raw);
+            switch (request.method) {
+                case "llm.countTokens": {
+                    const p = params;
+                    return llm.countTokens(p.model, p.messages, p.tools);
+                }
+                case "builtin.call": {
+                    const p = params;
+                    // A repeated callId for a finished built-in returns the same result instead of acting twice.
+                    const prior = builtinResults.get(request.callId);
+                    if (prior)
+                        return prior;
+                    const handler = input.builtinTools.includes(p.name) ? options.builtinHandler(p.name) : undefined;
+                    if (!handler)
+                        throw new GatewayError("not_allowed", `"${p.name}" is not a built-in tool of this run.`);
+                    const result = handler(p.argsJson);
+                    builtinResults.set(request.callId, result);
+                    return result;
+                }
+                case "host.call": {
+                    const p = params;
+                    claim(request.callId);
+                    if (!isPrivilegedBridgeName(p.bridge))
+                        throw new GatewayError("not_allowed", "unknown bridge");
+                    const key = `${p.tool}\u0000${p.invocation}`;
+                    let host = hosts.get(key);
+                    if (!host) {
+                        host = options.privilegedHostFor(p.tool, controller.signal);
+                        if (!host)
+                            throw new GatewayError("not_allowed", `"${p.tool}" is not a user tool of this run.`);
+                        hosts.set(key, host);
+                    }
+                    try {
+                        return await host[p.bridge](p.argsJson);
+                    }
+                    catch (err) {
+                        // What the tool sees, exactly as in-process (bridge.ts truncates the same way).
+                        const message = err instanceof Error ? err.message.slice(0, 1024) : "Host function failed.";
+                        throw new GatewayError("bridge_error", message);
+                    }
+                }
+                case "progress": {
+                    const p = params;
+                    // Turns from the worker, usage from this gateway's own metering.
+                    const progress = {
+                        turns: p.turns,
+                        usage: { tokensIn: usage.tokensIn, tokensOut: usage.tokensOut, costUsd: usage.costUsd },
+                    };
+                    await ctx.onProgress?.(progress);
+                    return null;
+                }
+                case "text": {
+                    const p = params;
+                    if (p.seq > lastTextSeq) {
+                        lastTextSeq = p.seq;
+                        ctx.onText?.(p.delta);
+                    }
+                    return null;
+                }
+                case "finish": {
+                    claim(request.callId);
+                    finished ??= params;
+                    return null;
+                }
+                default:
+                    throw new GatewayError("invalid_request", `"${request.method}" is a streaming method.`);
+            }
+        },
+    };
+    const { exitCode } = await options.launcher.run(input, gateway, controller.signal);
+    controller.abort();
+    if (cancelled || (!finished && (await options.drivability()) === "cancelled")) {
+        throw new SandboxRunCancelledError("The run was cancelled while its sandbox worker was running.");
+    }
+    if (!finished) {
+        gatewayLog.warn({ runId, exitCode }, "native sandbox worker exited without a result");
+        throw new Error(`native_sandbox_worker_exited: the sandbox worker exited (code ${exitCode}) without a result.`);
+    }
+    return {
+        status: finished.status,
+        finalText: finished.finalText,
+        turns: finished.turns,
+        ...(finished.error !== undefined ? { error: finished.error } : {}),
+        usage,
+    };
+}

package/dist/native-worker/http-server.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The native sandbox gateway's internal HTTP listener (NATIVE_GATEWAY_LISTEN).
+ * Deliberately separate from the public MCP/webhook server: only sandbox
+ * workers reach it (deployment network policy allows worker → this port and
+ * nothing else), and every request carries a one-run bearer capability.
+ *
+ *   POST /native-gateway/v1/call   body: GatewayRequest
+ *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
+ *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error }
+ */
+import { type Server } from "node:http";
+import { type GatewayServerDeps } from "./gateway-server.js";
+export declare const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
+export interface NativeGatewayListen {
+    host: string;
+    port: number;
+}
+/** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
+export declare function parseGatewayListen(value: string | undefined): NativeGatewayListen | undefined;
+export declare function createGatewayServer(deps: GatewayServerDeps): Server;
+/** Starts the listener; resolves once it is accepting connections. */
+export declare function startGatewayServer(listen: NativeGatewayListen, deps: GatewayServerDeps): Promise<Server>;

package/dist/native-worker/http-server.js

@@ -0,0 +1,109 @@
+/**
+ * The native sandbox gateway's internal HTTP listener (NATIVE_GATEWAY_LISTEN).
+ * Deliberately separate from the public MCP/webhook server: only sandbox
+ * workers reach it (deployment network policy allows worker → this port and
+ * nothing else), and every request carries a one-run bearer capability.
+ *
+ *   POST /native-gateway/v1/call   body: GatewayRequest
+ *   → application/json            { ok: true, result } | { ok: false, error: { code, message } }
+ *   → application/x-ndjson        (llm.stream) { event } … then { end: true } or { error }
+ */
+import { createServer } from "node:http";
+import { logger } from "../core/logger.js";
+import { serveGatewayRequest } from "./gateway-server.js";
+import { GatewayError, MAX_MESSAGE_BYTES } from "./protocol.js";
+const httpLog = logger.child({ module: "native-gateway-http" });
+export const NATIVE_GATEWAY_PATH = "/native-gateway/v1/call";
+/** Parses NATIVE_GATEWAY_LISTEN ("host:port" or ":port"); undefined when unset. */
+export function parseGatewayListen(value) {
+    if (!value)
+        return undefined;
+    const match = /^(.*):(\d{1,5})$/.exec(value.trim());
+    const port = match ? Number(match[2]) : NaN;
+    if (!match || !Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`NATIVE_GATEWAY_LISTEN must be host:port or :port (got "${value}").`);
+    }
+    return { host: match[1] || "0.0.0.0", port };
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_MESSAGE_BYTES) {
+                reject(new GatewayError("invalid_request", "message_too_large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.on("error", reject);
+    });
+}
+export function createGatewayServer(deps) {
+    return createServer({ maxHeaderSize: 16 * 1024 }, (req, res) => {
+        void (async () => {
+            const send = (status, body) => {
+                res.setHeader("content-type", "application/json");
+                res.writeHead(status);
+                res.end(JSON.stringify(body));
+            };
+            if (req.method === "GET" && req.url === "/healthz") {
+                // Ready when the database answers: every call needs it.
+                const healthy = await deps.db.$queryRaw `SELECT 1`.then(() => true, () => false);
+                send(healthy ? 200 : 503, { ok: healthy });
+                return;
+            }
+            if (req.method !== "POST" || req.url !== NATIVE_GATEWAY_PATH) {
+                send(404, { ok: false, error: { code: "not_found", message: "not found" } });
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse(await readBody(req));
+            }
+            catch (err) {
+                send(400, {
+                    ok: false,
+                    error: { code: "invalid_request", message: err instanceof GatewayError ? err.message : "body is not JSON" },
+                });
+                return;
+            }
+            const response = await serveGatewayRequest(deps, req.headers.authorization, body);
+            if (response.kind === "json") {
+                send(response.status, response.body);
+                return;
+            }
+            res.setHeader("content-type", "application/x-ndjson");
+            res.writeHead(200);
+            try {
+                for await (const event of response.events)
+                    res.write(`${JSON.stringify({ event })}\n`);
+                res.end(`${JSON.stringify({ end: true })}\n`);
+            }
+            catch (err) {
+                const error = err instanceof GatewayError
+                    ? { code: err.code, message: err.message }
+                    : { code: "internal", message: err instanceof Error ? err.message : String(err) };
+                res.end(`${JSON.stringify({ error })}\n`);
+            }
+        })().catch((err) => {
+            httpLog.error({ err }, "native gateway HTTP handler failed");
+            if (!res.headersSent)
+                res.writeHead(500);
+            res.end();
+        });
+    });
+}
+/** Starts the listener; resolves once it is accepting connections. */
+export async function startGatewayServer(listen, deps) {
+    const server = createGatewayServer(deps);
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(listen.port, listen.host, () => resolve());
+    });
+    httpLog.info({ host: listen.host, port: listen.port }, "native sandbox gateway listening");
+    return server;
+}

package/dist/native-worker/http-transport.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The worker's HTTP transport to the native sandbox gateway. One-shot calls are
+ * retried with the same request (same callId) on a connection failure until a
+ * deadline, so a control-plane replica restarting is a retry, not a failure:
+ * the gateway replays a finished call's result instead of acting again. A
+ * model stream is never retried — its reservation is already taken.
+ */
+import type { GatewayTransport } from "./worker.js";
+export interface HttpTransportOptions {
+    url: string;
+    capability: string;
+    fetch?: typeof globalThis.fetch;
+    /** How long a one-shot call keeps retrying connection failures. */
+    retryForMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function createHttpTransport(options: HttpTransportOptions): GatewayTransport;

package/dist/native-worker/http-transport.js

@@ -0,0 +1,88 @@
+/**
+ * The worker's HTTP transport to the native sandbox gateway. One-shot calls are
+ * retried with the same request (same callId) on a connection failure until a
+ * deadline, so a control-plane replica restarting is a retry, not a failure:
+ * the gateway replays a finished call's result instead of acting again. A
+ * model stream is never retried — its reservation is already taken.
+ */
+import { GatewayError } from "./protocol.js";
+const RETRY_DELAYS_MS = [100, 250, 500, 1_000, 2_000, 4_000];
+export function createHttpTransport(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const retryForMs = options.retryForMs ?? 120_000;
+    const post = (request) => fetchImpl(options.url, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${options.capability}` },
+        body: JSON.stringify(request),
+    });
+    const gatewayError = (error, status) => new GatewayError((error?.code ?? "internal"), error?.message ?? `gateway answered ${status}`);
+    return {
+        async call(request) {
+            const giveUpAt = Date.now() + retryForMs;
+            for (let attempt = 0;; attempt += 1) {
+                let response;
+                try {
+                    response = await post(request);
+                }
+                catch (err) {
+                    if (Date.now() >= giveUpAt) {
+                        throw new GatewayError("internal", `gateway unreachable: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    await sleep(RETRY_DELAYS_MS[Math.min(attempt, RETRY_DELAYS_MS.length - 1)]);
+                    continue;
+                }
+                const body = (await response.json().catch(() => undefined));
+                if (body?.ok === true)
+                    return body.result;
+                // Isolation not proven yet (a pod's NetworkPolicy is still being programmed): wait and ask again.
+                if (body?.ok === false && body.error.code === "not_ready" && Date.now() < giveUpAt) {
+                    await sleep(RETRY_DELAYS_MS[Math.min(attempt, RETRY_DELAYS_MS.length - 1)]);
+                    continue;
+                }
+                throw gatewayError(body?.ok === false ? body.error : undefined, response.status);
+            }
+        },
+        async *stream(request) {
+            const giveUpAt = Date.now() + retryForMs;
+            let response;
+            for (let attempt = 0;; attempt += 1) {
+                try {
+                    response = await post(request);
+                }
+                catch (err) {
+                    throw new GatewayError("internal", `gateway unreachable: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                if (response.headers.get("content-type")?.includes("application/x-ndjson") && response.body)
+                    break;
+                const body = (await response.json().catch(() => undefined));
+                // Refused before any reservation was taken, so asking again is safe.
+                if (body?.error?.code === "not_ready" && Date.now() < giveUpAt) {
+                    await sleep(RETRY_DELAYS_MS[Math.min(attempt, RETRY_DELAYS_MS.length - 1)]);
+                    continue;
+                }
+                throw gatewayError(body?.error, response.status);
+            }
+            const decoder = new TextDecoder();
+            let buffer = "";
+            for await (const chunk of response.body) {
+                buffer += decoder.decode(chunk, { stream: true });
+                let newline;
+                while ((newline = buffer.indexOf("\n")) >= 0) {
+                    const line = buffer.slice(0, newline);
+                    buffer = buffer.slice(newline + 1);
+                    if (!line)
+                        continue;
+                    const frame = JSON.parse(line);
+                    if (frame.event)
+                        yield frame.event;
+                    else if (frame.error)
+                        throw gatewayError(frame.error, 200);
+                    else if (frame.end)
+                        return;
+                }
+            }
+            throw new GatewayError("internal", "The gateway stream ended without a result.");
+        },
+    };
+}

package/dist/native-worker/kubernetes-isolation.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Kubernetes objects for one sandbox-mode native run (docs/native-sandbox.md), as pure builders —
+ * the launcher creates exactly these and attests what the API server stored against them. One pod
+ * per run, with no service-account token, a read-only non-root container holding no credentials,
+ * its WorkerInput (capability included) mounted read-only from a per-run Secret, and a
+ * NetworkPolicy whose only egress is the native gateway's port. Names carry a hash of the run id,
+ * never the id itself.
+ */
+import type { V1NetworkPolicy, V1Pod, V1Secret } from "@kubernetes/client-node";
+import { type KubernetesPlatform } from "../providers/jobs/kubernetes-platform.js";
+import { nativeWarmWorkerName, type NativeWorkerLimits } from "./docker-isolation.js";
+export { nativeWarmWorkerName };
+import type { WorkerInput } from "./protocol.js";
+export declare const NATIVE_RUN_COMPONENT_LABEL: {
+    readonly "wardby.io/component": "native-run";
+};
+export declare const NATIVE_GATEWAY_POD_LABEL: {
+    readonly "app.kubernetes.io/name": "wardby-native-gateway";
+};
+export declare const NATIVE_RUN_SHA_LABEL = "wardby.io/run-sha256";
+/** The label selector listing every native run pod (the janitor's listing). */
+export declare const NATIVE_RUN_SELECTOR = "wardby.io/component=native-run";
+export declare const NATIVE_WORKER_CONTAINER = "worker";
+export declare const NATIVE_INPUT_MOUNT = "/run/wardby/input";
+export declare const NATIVE_INPUT_KEY = "input.json";
+export declare const NATIVE_INPUT_FILE = "/run/wardby/input/input.json";
+export interface NativeKubernetesNames {
+    runSha: string;
+    pod: string;
+    policy: string;
+    secret: string;
+}
+export declare function nativeKubernetesNames(runId: string): NativeKubernetesNames;
+export declare function nativeRunLabels(runId: string): Record<string, string>;
+export declare function buildNativeInputSecret(input: WorkerInput, namespace: string): V1Secret;
+export interface NativeRunPodOptions {
+    runId: string;
+    namespace: string;
+    image: string;
+    limits: NativeWorkerLimits;
+    /** The pod's hard lifetime: the run's session deadline. */
+    activeDeadlineSeconds: number;
+    runtimeClassName?: string;
+    /** The cluster's admission rules the pod must already satisfy (KUBERNETES_PLATFORM). Default: "generic". */
+    platform?: KubernetesPlatform;
+    /** KUBERNETES_RUN_PRIORITY_CLASS: the class must exist in the cluster, or every create is refused. */
+    priorityClassName?: string;
+}
+export declare const NATIVE_SANDBOX_PLATFORM_ERROR = "native_sandbox_platform_unsupported";
+export declare function buildNativeRunPod(options: NativeRunPodOptions): V1Pod;
+/** The labels of every warm pool pod: still a native-run pod (the gateway admits it), never a run's. */
+export declare const NATIVE_WARM_POOL_LABEL: {
+    readonly "wardby.io/pool": "warm";
+};
+export declare const NATIVE_WARM_TOKEN_LABEL = "wardby.io/warm-worker";
+/** The label selector listing every warm pool pod. */
+export declare const NATIVE_WARM_SELECTOR = "wardby.io/component=native-run,wardby.io/pool=warm";
+export declare function nativeWarmLabels(token: string): Record<string, string>;
+export interface NativeWarmPodOptions extends Omit<NativeRunPodOptions, "runId"> {
+    token: string;
+    /** NATIVE_WORKER_INPUT_WAIT_MS: how long the worker waits to be claimed before it exits. */
+    waitMs: number;
+}
+/** A warm pool pod (native sandbox phase 6): no input yet; it waits for one delivered by exec. */
+export declare function buildNativeWarmPod(options: NativeWarmPodOptions): V1Pod;
+/** Ingress: none. Egress: the native gateway's pods, on the gateway port only. */
+export declare function buildNativeRunNetworkPolicy(runId: string, namespace: string): V1NetworkPolicy;
+/** A warm pool pod's policy: the same egress, selecting the pod by its token. */
+export declare function buildNativeWarmNetworkPolicy(token: string, namespace: string): V1NetworkPolicy;
+/** Exit codes of the in-pod enforcement probe. */
+export declare const NATIVE_PROBE: {
+    readonly proven: 0;
+    readonly gatewayUnreachable: 3;
+    readonly denyReachable: 4;
+    readonly outsideReachable: 5;
+};
+/** Addresses a worker must not reach: the internet, and the cloud metadata endpoints (node and workload credentials). */
+export declare const NATIVE_PROBE_OUTSIDE: readonly {
+    host: string;
+    port: number;
+}[];
+/**
+ * Run inside the worker container (exec): proves the pod's egress is the gateway port and nothing
+ * else — the gateway answers, while its deny port (same address, another port) and every outside
+ * address do not. A connection that is refused or times out both count as unreachable.
+ */
+export declare function nativeEnforcementProbe(gatewayHost: string, outside?: readonly {
+    host: string;
+    port: number;
+}[]): string[];