@aerol-ai/aerolvm-sdk 0.5.2 → 0.5.4

package/dist/index.d.ts

@@ -3,4 +3,4 @@ export { Sandbox } from "./Sandbox.js";
 export { Image } from "./Image.js";
 export type { MicroVMConfig } from "./MicroVM.js";
 export type { RetryConfig } from "./internal/client.js";
-export type { AddCustomDomainOptions, BinaryLike, BuildImageOptions, BuildImagePushOptions, BuildImageResult, CloneGeneration, CreateOptions, CreateSessionOptions, CreateTemplateOptions, CreateWasmModuleOptions, CustomDomain, CustomDomainDNSRecords, CustomDomainStatus, DNSRecord, DNSRecordType, ExecRequest, ExecResult, ExecExitInfo, ExposedPort, ExposePortOptions, ExposeProtocol, ExposeResult, Failover, FailoverPolicy, HealthStatus, IngressTarget, IngressTargetSource, Lifecycle, MountSpec, MountSpecRedacted, MountType, RegisterSnapshotOptions, RegistryAuth, ResizeOptions, Sandbox as SandboxData, SandboxSnapshot, SandboxStatus, Session, SessionAttachHandle, SessionAttachOptions, SessionStatus, Template, TemplatePushState, TemplateStatus, WasmModule, WasmModuleStatus, PushWasmModuleOptions, PushWasmModuleResult, UpdateLifecycleOptions, } from "./types.js";
+export type { AddCustomDomainOptions, BinaryLike, BuildImageOptions, BuildImagePushOptions, BuildImageResult, CloneGeneration, CreateOptions, CreateSessionOptions, CreateTemplateOptions, CreateWasmModuleOptions, CustomDomain, CustomDomainDNSRecords, CustomDomainStatus, DNSRecord, DNSRecordType, ExecRequest, ExecResult, ExecExitInfo, ExposedPort, ExposePortOptions, ExposeProtocol, ExposeResult, Failover, FailoverPolicy, HealthStatus, IngressTarget, IngressTargetSource, Lifecycle, MountSpec, MountSpecRedacted, MountType, PlatformVolumeMount, RegisterSnapshotOptions, RegistryAuth, ResizeOptions, Sandbox as SandboxData, SandboxSnapshot, SandboxStatus, Session, SessionAttachHandle, SessionAttachOptions, SessionStatus, Template, TemplatePushState, TemplateStatus, WasmModule, WasmModuleStatus, PushWasmModuleOptions, PushWasmModuleResult, UpdateLifecycleOptions, } from "./types.js";

package/dist/internal/client.js

@@ -610,11 +610,16 @@ function toApiCreateOptions(options) {
         env: options.env,
         os_user: options.osUser,
         network_block_all: options.networkBlockAll,
+        network_allow_out: options.networkAllowOut,
+        network_deny_out: options.networkDenyOut,
+        allow_public_traffic: options.allowPublicTraffic,
+        mask_request_host: options.maskRequestHost,
         network_bytes_in_limit: options.networkBytesInLimit,
         network_bytes_out_limit: options.networkBytesOutLimit,
         registry: options.registry,
         container_command: options.containerCommand,
         mounts: options.mounts?.map(toApiMountSpec),
+        platform_volumes: options.platformVolumes?.map(toApiPlatformVolumeMount),
         lifecycle: options.lifecycle ? toApiLifecycle(options.lifecycle) : undefined,
         failover: options.failover ? toApiFailover(options.failover) : undefined,
         runtime: options.runtime,
@@ -852,6 +857,13 @@ function toApiMountSpec(mount) {
         read_only: mount.readOnly,
     };
 }
+function toApiPlatformVolumeMount(volume) {
+    return {
+        name: volume.name,
+        path: volume.path,
+        read_only: volume.readOnly,
+    };
+}
 function fromApiMountSpecRedacted(mount) {
     return {
         type: mount.type,

package/dist/types.d.ts

@@ -65,6 +65,20 @@ export interface MountSpecRedacted {
     readOnly: boolean;
     hasCredentials: boolean;
 }
+/**
+ * A named, operator-backed persistent volume to attach by name. The operator
+ * configures the shared backend (S3/NFS); you never supply storage coordinates
+ * or credentials. Persists across the sandbox lifecycle and can be re-attached
+ * by name from another sandbox.
+ */
+export interface PlatformVolumeMount {
+    /** Volume name, scoped to your tenant. */
+    name: string;
+    /** Absolute path to mount it at inside the sandbox. */
+    path: string;
+    /** Mount read-only. Defaults to read-write. */
+    readOnly?: boolean;
+}
 export interface Lifecycle {
     /** Duration in integer nanoseconds. */
     stopIfIdleFor?: number;
@@ -137,6 +151,32 @@ export interface CreateOptions {
     env?: Record<string, string>;
     osUser?: string;
     networkBlockAll?: boolean;
+    /**
+     * Egress allowlist of CIDRs. When set, the sandbox may reach only these
+     * destinations; all other outbound traffic is dropped by the host firewall.
+     * Mutually exclusive with `networkDenyOut`. For a full block use
+     * `networkBlockAll` instead.
+     */
+    networkAllowOut?: string[];
+    /**
+     * Egress blocklist of CIDRs. When set, the sandbox may reach anything except
+     * these destinations. Mutually exclusive with `networkAllowOut`.
+     */
+    networkDenyOut?: string[];
+    /**
+     * Whether the sandbox may be exposed to the public internet. Defaults to
+     * true; set `false` to make `exposePort` fail — the sandbox stays reachable
+     * only via the toolbox proxy and SSH gateway, not a public URL.
+     */
+    allowPublicTraffic?: boolean;
+    /**
+     * Rewrite the upstream `Host` header on ingress to exposed HTTP ports to this
+     * value. Frameworks that validate the Host (Vite `allowedHosts`,
+     * webpack-dev-server, Django `ALLOWED_HOSTS`) reject the per-sandbox public
+     * hostname; set this to a value they accept (e.g. `"localhost"`). Empty/unset
+     * passes the host through unchanged. HTTP-only; TCP/TLS exposures ignore it.
+     */
+    maskRequestHost?: string;
     /**
      * Cap on bytes the sandbox may receive from outside the container before its
      * ingress is dropped via per-IP iptables rule. `0` (default) is unlimited.
@@ -153,6 +193,12 @@ export interface CreateOptions {
     registry?: RegistryAuth;
     containerCommand?: string[];
     mounts?: MountSpec[];
+    /**
+     * Named, operator-backed persistent volumes to attach by name. Requires the
+     * operator to have enabled platform volumes; otherwise the create is rejected
+     * with 412. Only supported on the docker/gvisor runtimes.
+     */
+    platformVolumes?: PlatformVolumeMount[];
     lifecycle?: Lifecycle;
     failover?: Failover;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aerol-ai/aerolvm-sdk",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -21,7 +21,7 @@
     "test": "tsc -p tsconfig.test.json --outDir dist-test && node --test dist-test/*.test.js dist-test/internal/*.test.js"
   },
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "typescript": "^6.0.3",
     "tsx": "^4.22.4"
   }