@wardby/cli 0.5.3 → 0.7.0

package/dist/mcp/transport/streamable-http.js

@@ -11,9 +11,18 @@ import { handleHostUserCallback } from "../host-events/github-user-callback.js";
 import { canonicalUrl, HTTP_LIMITS, HttpBoundaryError, parseBody, readBody } from "./http-limits.js";
 import { browserHandler } from "../auth/self-hosted/browser.js";
 import { handleSecretElicitationForm, SECRET_ELICITATION_PATH } from "../tools/secret-elicitation-form.js";
+import { handleRunTranscriptDownload, RUN_TRANSCRIPT_DOWNLOAD_PATH } from "../tools/run-transcript-download.js";
 import { logger } from "../../core/logger.js";
 import { VIEWER_API_PREFIX } from "../../viewer/http.js";
 const httpLog = logger.child({ module: "streamable-http" });
+/**
+ * close() waits this long for open requests to finish, then cuts them. A
+ * connected MCP client's event stream never ends on its own, so without a
+ * limit close() would hold shutdown until the pod is killed. On Kubernetes
+ * the load balancer has already moved traffic away by then (preStop), and
+ * clients reconnect to another instance.
+ */
+export const CLOSE_GRACE_MS = 10_000;
 export function sendJson(res, status, body, headers = {}) {
     res
         .writeHead(status, { "content-type": "application/json", "cache-control": "no-store", ...headers })
@@ -35,7 +44,11 @@ export async function startHttpServer(opts) {
     ]);
     const validateHost = hostHeaderValidation([canonical.hostname]);
     const nodeHandler = toNodeHandler(createMcpHandler(opts.mcp.factory, { responseMode: opts.config.responseMode }));
+    // Requests still being answered, so a close that has to cut them can say which they were.
+    const open = new Map();
     const server = createServer({ maxHeaderSize: 16 * 1024, requireHostHeader: false }, (req, res) => {
+        open.set(res, { method: req.method ?? "", path: (req.url ?? "").split("?")[0], startedAt: Date.now() });
+        res.once("close", () => open.delete(res));
         void route(req, res).catch((err) => {
             if (res.headersSent) {
                 res.destroy();
@@ -114,6 +127,17 @@ export async function startHttpServer(opts) {
             });
             return;
         }
+        if (url.pathname === RUN_TRANSCRIPT_DOWNLOAD_PATH) {
+            // The signed link is the credential (no Authorization header); the
+            // token is never logged (open-request tracking keeps the path only).
+            await handleRunTranscriptDownload(req.method, url.searchParams.get("t"), res, {
+                verify: (token) => opts.mcp.verifyRequestState(token),
+                audience: "http",
+                db: opts.auth.db,
+                blobs: opts.blobs,
+            });
+            return;
+        }
         if (oauth && (await oauth(req, res, url, body)))
             return;
         const webhook = /^\/webhooks\/([^/]+)$/.exec(url.pathname);
@@ -203,7 +227,23 @@ export async function startHttpServer(opts) {
         port: typeof address === "object" && address ? address.port : opts.config.httpBind.port,
         close: () => new Promise((resolve, reject) => {
             opts.viewer?.closeStreams();
-            server.close((err) => (err ? reject(err) : resolve()));
+            const cut = setTimeout(() => {
+                const now = Date.now();
+                const requests = [...open.values()].map((r) => ({
+                    method: r.method,
+                    path: r.path,
+                    openSeconds: Math.round((now - r.startedAt) / 1000),
+                }));
+                httpLog.info({ requests }, "HTTP connections still open after the close grace; closing them");
+                server.closeAllConnections();
+            }, opts.closeGraceMs ?? CLOSE_GRACE_MS);
+            server.close((err) => {
+                clearTimeout(cut);
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
             server.closeIdleConnections();
         }),
     };

package/dist/native-worker/composition.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Builds the native sandbox executor from configuration (NATIVE_SANDBOX_*, docs/native-sandbox.md),
+ * or nothing when the native sandbox is not configured — sandbox-mode runs then fail closed.
+ */
+import { type Power } from "../core/power.js";
+import type { NativeRunProviders, RunnerDb } from "../core/runner.js";
+import { type GatewayLedgerDb } from "./ledger.js";
+import type { KubernetesApi } from "../providers/jobs/kubernetes-api.js";
+import { NativeSandboxExecutor, type ManagedWorkerLauncher } from "./sandbox-executor.js";
+import { type WarmWorkerLauncher } from "./warm-pool.js";
+import { type WarmPoolDb } from "./warm-pool-ledger.js";
+export declare function buildNativeSandboxExecutor(options: {
+    db: RunnerDb & GatewayLedgerDb & WarmPoolDb;
+    /** Read at call time: the composition root patches `executor` on after wrapping this one. */
+    providers: NativeRunProviders;
+    env?: NodeJS.ProcessEnv;
+    /** Tests only: replaces the launcher. */
+    launcher?: ManagedWorkerLauncher & Partial<WarmWorkerLauncher>;
+    /** Tests only: replaces the kubeconfig-backed client for NATIVE_SANDBOX_LAUNCHER=kubernetes. */
+    kubernetesApi?: KubernetesApi;
+    /** Low-power mode: the shared Power the Kubernetes launcher wakes the native gateway through. */
+    power?: Power;
+}): NativeSandboxExecutor | undefined;

package/dist/native-worker/composition.js

@@ -0,0 +1,77 @@
+/**
+ * Builds the native sandbox executor from configuration (NATIVE_SANDBOX_*, docs/native-sandbox.md),
+ * or nothing when the native sandbox is not configured — sandbox-mode runs then fail closed.
+ */
+import { loadNativeSandboxConfig } from "../config/providers.js";
+import { DISABLED_POWER } from "../core/power.js";
+import { lowPowerActive } from "../core/power-composition.js";
+import { nativeGatewayUrl } from "./docker-isolation.js";
+import { DockerNativeWorkerLauncher } from "./docker-launcher.js";
+import { PrismaGatewayLedger } from "./ledger.js";
+import { KubernetesNativeWorkerLauncher } from "./kubernetes-launcher.js";
+import { ClientNodeKubernetesApi } from "../providers/jobs/kubernetes-client.js";
+import { SANDBOX_RUN_MAX_SEC } from "../core/runner.js";
+import { NativeSandboxExecutor } from "./sandbox-executor.js";
+import { PooledWorkerLauncher } from "./warm-pool.js";
+import { PrismaWarmPoolLedger } from "./warm-pool-ledger.js";
+export function buildNativeSandboxExecutor(options) {
+    const env = options.env ?? process.env;
+    const config = loadNativeSandboxConfig(env);
+    if (!config)
+        return undefined;
+    // Only when low-power mode is actually on (as buildPower decides); otherwise it is ignored.
+    if (config.warmPoolSize > 0 && lowPowerActive(env)) {
+        throw new Error("WARDBY_LOW_POWER=1 requires NATIVE_SANDBOX_WARM_POOL_SIZE=0: an always-on warm pool defeats scale-to-zero.");
+    }
+    const limits = { cpus: config.cpus, memoryMb: config.memoryMb, pids: config.pids };
+    const markReady = (runId) => new PrismaGatewayLedger(options.db).markNetworkReadyForRun(runId);
+    const cold = options.launcher ??
+        (config.launcher === "kubernetes"
+            ? new KubernetesNativeWorkerLauncher({
+                api: options.kubernetesApi ?? new ClientNodeKubernetesApi({ context: config.context }),
+                namespace: config.namespace,
+                image: config.workerImage,
+                limits,
+                gatewayService: config.gatewayService,
+                runtimeClassName: config.runtimeClassName,
+                platform: config.platform,
+                priorityClassName: config.priorityClassName,
+                readyTimeoutMs: config.readyTimeoutMs,
+                enforcementTimeoutMs: config.enforcementTimeoutMs,
+                gatewayUrl: config.gatewayUrl,
+                deadlineSeconds: SANDBOX_RUN_MAX_SEC,
+                power: options.power ?? DISABLED_POWER,
+                // Isolation proven inside the pod: the gateway may now serve the run.
+                onNetworkProven: markReady,
+            })
+            : new DockerNativeWorkerLauncher({
+                image: config.workerImage,
+                gatewayContainer: config.gatewayContainer,
+                limits,
+            }));
+    // The pool also starts with size 0 when the launcher can run one: its first tick removes workers
+    // left from an earlier configuration, and nothing runs after that.
+    const launcher = isWarmCapable(cold)
+        ? new PooledWorkerLauncher({
+            ledger: new PrismaWarmPoolLedger(options.db),
+            launcher: cold,
+            size: config.warmPoolSize,
+            maxAgeMs: config.warmMaxAgeMs,
+            warmTimeoutMs: config.launcher === "kubernetes"
+                ? (config.readyTimeoutMs ?? 120_000) + (config.enforcementTimeoutMs ?? 30_000)
+                : 120_000,
+            onDelivered: markReady,
+        })
+        : cold;
+    return new NativeSandboxExecutor({
+        db: options.db,
+        providers: options.providers,
+        launcher,
+        // Kubernetes resolves the gateway's ClusterIP per launch (resolveGatewayUrl) unless overridden.
+        gatewayUrl: config.gatewayUrl ?? nativeGatewayUrl(),
+        maxConcurrent: config.maxConcurrent,
+    });
+}
+function isWarmCapable(launcher) {
+    return typeof launcher.startWarm === "function" && typeof launcher.deliver === "function";
+}

package/dist/native-worker/docker-isolation.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Docker objects for one sandbox-mode native run (docs/native-sandbox.md),
+ * built the way the coding launcher builds its own (providers/jobs/
+ * docker-isolation.ts): an internal per-run network whose only other member is
+ * the native gateway container, and a single-use worker container that can
+ * reach nothing else — no internet, no database, no Docker socket. Names carry
+ * an opaque hash of the run id, never the id itself.
+ */
+export declare const NATIVE_WORKER_UID = 10001;
+export declare const NATIVE_GATEWAY_ALIAS = "wardby-native-gateway";
+export declare const NATIVE_GATEWAY_PORT = 8790;
+/** The gateway's witness port: never reachable from a worker (see coding-proxy/deny-port.ts). */
+export declare const NATIVE_GATEWAY_DENY_PORT = 8791;
+export declare const NATIVE_WORKER_TMP_MB = 64;
+export interface NativeWorkerLimits {
+    cpus: number;
+    memoryMb: number;
+    pids: number;
+}
+export declare const DEFAULT_NATIVE_WORKER_LIMITS: NativeWorkerLimits;
+export interface NativeIsolationNames {
+    network: string;
+    worker: string;
+}
+export declare function nativeIsolationNames(runId: string): NativeIsolationNames;
+/** The label value tying a Docker object to its run, without exposing the run id. */
+export declare function nativeRunLabel(runId: string): string;
+/** A warm pool worker's name (native sandbox phase 6): its random token, never a run's hash. */
+export declare function nativeWarmWorkerName(token: string): string;
+export declare function nativeWarmIsolationNames(token: string): NativeIsolationNames;
+/** Docker's label filter for every warm pool object, and the label carrying its token. */
+export declare const NATIVE_WARM_LABEL_FILTER = "io.wardby.pool=warm";
+export declare const NATIVE_WARM_TOKEN_LABEL = "io.wardby.warm-worker";
+/** Docker's label filter for every native worker object (the janitor lists by it). */
+export declare const NATIVE_WORKER_LABEL_FILTER = "io.wardby.component=native-worker";
+export declare function buildNativeNetworkCreateArgs(runId: string): string[];
+export declare function buildNativeWarmNetworkCreateArgs(token: string): string[];
+/** Joins the gateway container to the run's network under the name workers dial. */
+export declare function buildGatewayConnectArgs(runId: string, gatewayContainer: string): string[];
+export declare function gatewayConnectArgs(network: string, gatewayContainer: string): string[];
+export declare function buildGatewayDisconnectArgs(runId: string, gatewayContainer: string): string[];
+export declare function gatewayDisconnectArgs(network: string, gatewayContainer: string): string[];
+/**
+ * `docker run -i` for the worker: its WorkerInput (capability included) arrives on stdin, so the
+ * capability is never in its environment, argv, labels, or `docker inspect`. Not `--rm`: the
+ * executor reads the exit code, then removes it.
+ */
+export declare function buildNativeWorkerRunArgs(input: {
+    runId: string;
+    image: string;
+    limits: NativeWorkerLimits;
+}): string[];
+/**
+ * `docker run -d` for a warm pool worker: no input yet. It waits for one written into its /tmp by
+ * `docker exec -i` after a run claims it (warm-delivery.ts), so the capability still never reaches
+ * its environment, argv, or labels.
+ */
+export declare function buildNativeWarmWorkerRunArgs(input: {
+    token: string;
+    image: string;
+    limits: NativeWorkerLimits;
+    waitMs: number;
+}): string[];
+/** The URL a worker dials: the gateway's alias on its own run network. */
+export declare function nativeGatewayUrl(port?: number): string;

package/dist/native-worker/docker-isolation.js

@@ -0,0 +1,183 @@
+/**
+ * Docker objects for one sandbox-mode native run (docs/native-sandbox.md),
+ * built the way the coding launcher builds its own (providers/jobs/
+ * docker-isolation.ts): an internal per-run network whose only other member is
+ * the native gateway container, and a single-use worker container that can
+ * reach nothing else — no internet, no database, no Docker socket. Names carry
+ * an opaque hash of the run id, never the id itself.
+ */
+import { isImmutableDockerImage, isolationToken } from "../providers/jobs/docker-isolation.js";
+import { createHash } from "node:crypto";
+import { WARM_INPUT_FILE } from "./warm-delivery.js";
+export const NATIVE_WORKER_UID = 10001;
+export const NATIVE_GATEWAY_ALIAS = "wardby-native-gateway";
+export const NATIVE_GATEWAY_PORT = 8790;
+/** The gateway's witness port: never reachable from a worker (see coding-proxy/deny-port.ts). */
+export const NATIVE_GATEWAY_DENY_PORT = 8791;
+export const NATIVE_WORKER_TMP_MB = 64;
+const LABEL_MANAGED = "io.wardby.managed=true";
+const LABEL_COMPONENT = "io.wardby.component=native-worker";
+export const DEFAULT_NATIVE_WORKER_LIMITS = { cpus: 1, memoryMb: 512, pids: 128 };
+export function nativeIsolationNames(runId) {
+    const token = isolationToken(runId);
+    return { network: `wardby-nnet-${token}`, worker: `wardby-native-${token}` };
+}
+/** The label value tying a Docker object to its run, without exposing the run id. */
+export function nativeRunLabel(runId) {
+    return createHash("sha256").update(runId).digest("hex");
+}
+function labels(runId) {
+    return [
+        "--label",
+        LABEL_MANAGED,
+        "--label",
+        LABEL_COMPONENT,
+        "--label",
+        `io.wardby.run-sha256=${nativeRunLabel(runId)}`,
+    ];
+}
+/** A warm pool worker's name (native sandbox phase 6): its random token, never a run's hash. */
+export function nativeWarmWorkerName(token) {
+    if (!/^[0-9a-f]{20}$/.test(token))
+        throw new Error("native_sandbox_invalid_warm_token");
+    return `wardby-nwarm-${token}`;
+}
+export function nativeWarmIsolationNames(token) {
+    return { network: `wardby-nwnet-${token}`, worker: nativeWarmWorkerName(token) };
+}
+/** Docker's label filter for every warm pool object, and the label carrying its token. */
+export const NATIVE_WARM_LABEL_FILTER = "io.wardby.pool=warm";
+export const NATIVE_WARM_TOKEN_LABEL = "io.wardby.warm-worker";
+function warmLabels(token) {
+    return [
+        "--label",
+        LABEL_MANAGED,
+        "--label",
+        LABEL_COMPONENT,
+        "--label",
+        NATIVE_WARM_LABEL_FILTER,
+        "--label",
+        `${NATIVE_WARM_TOKEN_LABEL}=${token}`,
+    ];
+}
+/** Docker's label filter for every native worker object (the janitor lists by it). */
+export const NATIVE_WORKER_LABEL_FILTER = LABEL_COMPONENT;
+export function buildNativeNetworkCreateArgs(runId) {
+    return networkCreateArgs(nativeIsolationNames(runId).network, labels(runId));
+}
+export function buildNativeWarmNetworkCreateArgs(token) {
+    return networkCreateArgs(nativeWarmIsolationNames(token).network, warmLabels(token));
+}
+function networkCreateArgs(network, objectLabels) {
+    return [
+        "network",
+        "create",
+        "--driver",
+        "bridge",
+        "--internal",
+        "--ipv6=false",
+        "--opt",
+        "com.docker.network.bridge.gateway_mode_ipv4=isolated",
+        "--opt",
+        "com.docker.network.bridge.gateway_mode_ipv6=isolated",
+        ...objectLabels,
+        network,
+    ];
+}
+/** Joins the gateway container to the run's network under the name workers dial. */
+export function buildGatewayConnectArgs(runId, gatewayContainer) {
+    return gatewayConnectArgs(nativeIsolationNames(runId).network, gatewayContainer);
+}
+export function gatewayConnectArgs(network, gatewayContainer) {
+    return ["network", "connect", "--alias", NATIVE_GATEWAY_ALIAS, network, gatewayContainer];
+}
+export function buildGatewayDisconnectArgs(runId, gatewayContainer) {
+    return gatewayDisconnectArgs(nativeIsolationNames(runId).network, gatewayContainer);
+}
+export function gatewayDisconnectArgs(network, gatewayContainer) {
+    return ["network", "disconnect", "--force", network, gatewayContainer];
+}
+/**
+ * `docker run -i` for the worker: its WorkerInput (capability included) arrives on stdin, so the
+ * capability is never in its environment, argv, labels, or `docker inspect`. Not `--rm`: the
+ * executor reads the exit code, then removes it.
+ */
+export function buildNativeWorkerRunArgs(input) {
+    const names = nativeIsolationNames(input.runId);
+    return workerRunArgs({ ...input, names, mode: ["-i"], env: [], objectLabels: labels(input.runId) });
+}
+/**
+ * `docker run -d` for a warm pool worker: no input yet. It waits for one written into its /tmp by
+ * `docker exec -i` after a run claims it (warm-delivery.ts), so the capability still never reaches
+ * its environment, argv, or labels.
+ */
+export function buildNativeWarmWorkerRunArgs(input) {
+    return workerRunArgs({
+        ...input,
+        names: nativeWarmIsolationNames(input.token),
+        mode: ["-d"],
+        env: [
+            "--env",
+            `NATIVE_WORKER_INPUT_FILE=${WARM_INPUT_FILE}`,
+            "--env",
+            `NATIVE_WORKER_INPUT_WAIT_MS=${Math.floor(input.waitMs)}`,
+        ],
+        objectLabels: warmLabels(input.token),
+    });
+}
+function workerRunArgs(input) {
+    const { image, limits, names } = input;
+    if (!isImmutableDockerImage(image)) {
+        throw new Error("native_sandbox_image_not_pinned: the worker image must be a digest (repo@sha256:...) or a local image id.");
+    }
+    return [
+        "run",
+        ...input.mode,
+        "--name",
+        names.worker,
+        "--pull",
+        "never",
+        "--user",
+        `${NATIVE_WORKER_UID}:${NATIVE_WORKER_UID}`,
+        "--network",
+        names.network,
+        "--read-only",
+        "--tmpfs",
+        `/tmp:rw,noexec,nosuid,nodev,size=${NATIVE_WORKER_TMP_MB}m`,
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges=true",
+        "--security-opt",
+        "seccomp=builtin",
+        "--cgroupns",
+        "private",
+        "--ipc",
+        "none",
+        "--cpus",
+        String(limits.cpus),
+        "--memory",
+        `${limits.memoryMb}m`,
+        "--memory-swap",
+        `${limits.memoryMb}m`,
+        "--memory-swappiness",
+        "0",
+        "--pids-limit",
+        String(limits.pids),
+        "--restart",
+        "no",
+        "--log-driver",
+        "local",
+        "--log-opt",
+        "max-size=1m",
+        "--log-opt",
+        "max-file=2",
+        ...input.env,
+        ...input.objectLabels,
+        image,
+    ];
+}
+/** The URL a worker dials: the gateway's alias on its own run network. */
+export function nativeGatewayUrl(port = NATIVE_GATEWAY_PORT) {
+    return `http://${NATIVE_GATEWAY_ALIAS}:${port}/native-gateway/v1/call`;
+}

package/dist/native-worker/docker-launcher.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Launches, watches, stops, and removes native sandbox workers on the local
+ * Docker engine (docs/native-sandbox.md), from the isolation plan in
+ * docker-isolation.ts. Every operation is idempotent and keyed by the run id,
+ * so the executor can retry, a second launch attaches instead of starting
+ * twice, and a restarted server re-finds a running worker by name.
+ */
+import { type NativeWorkerLimits } from "./docker-isolation.js";
+import type { DetachedWorkerLauncher, WorkerHandle, WorkerLaunchOptions } from "./launch.js";
+import type { WorkerInput } from "./protocol.js";
+import { type WarmWorkerLauncher } from "./warm-pool.js";
+/**
+ * Bounded, so a noisy worker cannot flood the log. The worker holds no long-lived credentials (only
+ * its run's gateway capability), and it redacts the secret values it received (every `secrets.get`
+ * result, and the capability) from everything it writes to stderr, its failure line and logger lines
+ * included (stderr-redaction.ts), with the console bridge's redactor and its minimum length. The
+ * worker is untrusted, so the launcher masks the tail again itself (workerTailFields).
+ */
+export declare const WORKER_STDERR_TAIL_CHARS = 2000;
+/** How long a failed worker's diagnostic (its log read and its secret values read) may take in all. */
+export declare const WORKER_TAIL_TIMEOUT_MS = 10000;
+/**
+ * Log fields for a failed worker's output. `stderrTailOmitted` says why there is no tail although
+ * there may be output: its secret values could not be read (so it could not be redacted), or its
+ * log could not be read (Kubernetes).
+ */
+export interface WorkerTailFields {
+    stderrTail?: string;
+    stderrTailOmitted?: "secrets_unavailable" | "log_read_failed";
+}
+/** `promise`, or a rejection once `ms` pass first. */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T>;
+/**
+ * A failed worker's output tail as log fields: `stderrTail`, masked by exact value through the
+ * shared redactor against every secret value delivered to that worker (its gateway capability,
+ * from its input, and each value its tools may read, from `secretValues`, with their JSON-escaped
+ * forms). When those values are not given, cannot be read, or are not read within `timeoutMs`, no
+ * tail: `stderrTailOmitted: "secrets_unavailable"` (fail closed). No fields when the output is empty.
+ *
+ * `cut`: `output` is a slice of a longer output (a log read bounded by lines or bytes), so it may
+ * begin (`start`) or end (`end`) inside a value, which no exact match finds; as many characters as
+ * the longest value less one are masked at each cut end too.
+ */
+export declare function workerTailFields(output: string, input: WorkerInput, secretValues: (() => Promise<readonly string[]>) | undefined, cut?: {
+    start?: boolean;
+    end?: boolean;
+}, timeoutMs?: number): Promise<WorkerTailFields>;
+export interface DockerResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}
+/** The Docker CLI as this launcher uses it; tests replace it. */
+export interface DockerCli {
+    run(args: string[], options?: {
+        input?: string;
+        timeoutMs?: number;
+    }): Promise<DockerResult>;
+}
+export declare function processDockerCli(binary?: string): DockerCli;
+export type NativeWorkerState = {
+    state: "running";
+} | {
+    state: "exited";
+    exitCode: number;
+} | {
+    state: "missing";
+};
+export interface DockerNativeWorkerLauncherOptions {
+    image: string;
+    /** The container running `wardby native-gateway`, joined to each run's network. */
+    gatewayContainer: string;
+    limits: NativeWorkerLimits;
+    docker?: DockerCli;
+}
+export declare class DockerNativeWorkerLauncher implements DetachedWorkerLauncher, WarmWorkerLauncher {
+    private readonly options;
+    private readonly docker;
+    constructor(options: DockerNativeWorkerLauncherOptions);
+    private must;
+    /** The image must be present and pinned; a digest is pulled once, a local id must already exist. */
+    private ensureImage;
+    launch(input: WorkerInput, launchOptions?: WorkerLaunchOptions): Promise<WorkerHandle>;
+    /** Waits for (and reports) the worker's exit; usable after a server restart. */
+    handle(runId: string): WorkerHandle;
+    private handleByName;
+    inspect(runId: string): Promise<NativeWorkerState>;
+    private inspectByName;
+    kill(runId: string): Promise<void>;
+    /** Removes the worker, its network, and the gateway's membership of it. Idempotent. */
+    remove(runId: string): Promise<void>;
+    /** Removes a worker found by the janitor, by its container name (its network shares the name's token). */
+    removeByWorkerName(workerName: string): Promise<void>;
+    /** Every native worker container this engine holds, with its run-hash label (for the janitor). */
+    listWorkers(): Promise<{
+        name: string;
+        runHash: string;
+    }[]>;
+    warmSpecHash(waitMs: number): string;
+    /** Its network is internal from creation, so a running container is already isolated: claimable. */
+    startWarm(token: string, waitMs: number): Promise<void>;
+    /** Still running, and attached to its own network and nothing else. */
+    reattestWarm(token: string): Promise<boolean>;
+    deliver(token: string, input: WorkerInput): Promise<void>;
+    warmHandle(token: string): WorkerHandle;
+    inspectWarm(token: string): Promise<NativeWorkerState>;
+    killWarm(token: string): Promise<void>;
+    removeWarm(token: string): Promise<void>;
+    listWarm(): Promise<string[]>;
+}