@ai-sdk/sandbox-vercel 1.0.71 → 1.0.73

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @ai-sdk/sandbox-vercel
 
+## 1.0.73
+
+### Patch Changes
+
+- Updated dependencies [62a9c2a]
+- Updated dependencies [d25cae2]
+  - @ai-sdk/harness@1.0.73
+
+## 1.0.72
+
+### Patch Changes
+
+- 69bb613: feat(harness): support request transformations in network sandbox abstraction and use it to apply credential brokering when available
+- 52bc889: feat(harness): add `getPortEndpoint()` as more comprehensive replacement to `getPortUrl()` (now deprecated) in `HarnessV1NetworkSandboxSession`
+- Updated dependencies [69bb613]
+- Updated dependencies [52bc889]
+- Updated dependencies [4cd4989]
+  - @ai-sdk/harness@1.0.72
+
 ## 1.0.71
 
 ### Patch Changes

package/README.md

@@ -45,7 +45,7 @@ Credential resolution failures throw
 `HarnessSandboxAuthenticationError` from `@ai-sdk/harness` and preserve the
 underlying Vercel SDK error as `cause`.
 
-`networkSandboxSession.restricted()` is typed as `Experimental_SandboxSession`, so it's safe to pass to AI SDK tools that accept `experimental_sandbox`. The network sandbox session itself carries the infra surface (`ports`, `getPortUrl`, `setNetworkPolicy`, `stop`) that only the harness should reach for.
+`networkSandboxSession.restricted()` is typed as `Experimental_SandboxSession`, so it's safe to pass to AI SDK tools that accept `experimental_sandbox`. The network sandbox session itself carries the infra surface (`ports`, `getPortEndpoint`, `setNetworkPolicy`, `setRequestTransformations`, `addRequestTransformations`, `stop`) that only the harness should reach for. `getPortUrl` remains available as a deprecated compatibility wrapper.
 
 The flat-field settings are aliased directly from `@vercel/sandbox`'s `Sandbox.create` parameters, so every option Vercel supports — including its native `NetworkPolicy` — is available without re-declaration:
 
@@ -85,3 +85,10 @@ await networkSandboxSession.setNetworkPolicy?.({
 ```
 
 `HarnessV1NetworkPolicy` is the harness-level abstraction used here. The provider translates it to `@vercel/sandbox`'s native `NetworkPolicy` for enforcement.
+
+### Request transformations and credential brokering
+
+Vercel Sandbox supports outbound request transformations for use cases such as
+credential brokering. `setRequestTransformations()` replaces the managed rules,
+while `addRequestTransformations()` adds rules without replacing them. Network
+access policies remain authoritative over which hosts can be reached.

package/dist/index.js

@@ -1,3 +1,12 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+
 // src/vercel-sandbox.ts
 import {
   HarnessSandboxAuthenticationError
@@ -5,9 +14,504 @@ import {
 import { Sandbox } from "@vercel/sandbox";
 
 // src/vercel-network-sandbox-session.ts
+import {
+  HarnessCapabilityUnsupportedError as HarnessCapabilityUnsupportedError2
+} from "@ai-sdk/harness";
+
+// src/vercel-network-policy-manager.ts
 import {
   HarnessCapabilityUnsupportedError
 } from "@ai-sdk/harness";
+var VERCEL_PROVIDER_ID = "vercel-sandbox";
+var _sandbox, _state, _mutationQueue, _VercelNetworkPolicyManager_instances, enqueueMutation_fn, inspectPolicy_fn, applyState_fn;
+var VercelNetworkPolicyManager = class {
+  constructor({ sandbox }) {
+    __privateAdd(this, _VercelNetworkPolicyManager_instances);
+    __privateAdd(this, _sandbox);
+    __privateAdd(this, _state);
+    __privateAdd(this, _mutationQueue, Promise.resolve());
+    __privateSet(this, _sandbox, sandbox);
+  }
+  setNetworkPolicy(policy) {
+    return __privateMethod(this, _VercelNetworkPolicyManager_instances, enqueueMutation_fn).call(this, async () => {
+      var _a, _b;
+      const inspection = __privateMethod(this, _VercelNetworkPolicyManager_instances, inspectPolicy_fn).call(this);
+      if (__privateGet(this, _state) == null && inspection.requestTransformationHosts.length > 0) {
+        throw createPolicyConflictError(
+          "Cannot set the network policy because the current Vercel Sandbox policy contains request transformations whose redacted values cannot be preserved safely. Replace them explicitly with setRequestTransformations() or rehydrate them with addRequestTransformations() first."
+        );
+      }
+      await __privateMethod(this, _VercelNetworkPolicyManager_instances, applyState_fn).call(this, {
+        accessPolicy: toNetworkAccessPolicy(policy),
+        requestTransformations: (_b = (_a = __privateGet(this, _state)) == null ? void 0 : _a.requestTransformations.map(cloneRequestTransformation)) != null ? _b : [],
+        forwardRules: inspection.forwardRules.map(cloneForwardRule),
+        currentPolicy: inspection.currentPolicy
+      });
+    });
+  }
+  setRequestTransformations(transformations) {
+    return __privateMethod(this, _VercelNetworkPolicyManager_instances, enqueueMutation_fn).call(this, async () => {
+      const inspection = __privateMethod(this, _VercelNetworkPolicyManager_instances, inspectPolicy_fn).call(this);
+      await __privateMethod(this, _VercelNetworkPolicyManager_instances, applyState_fn).call(this, {
+        accessPolicy: inspection.accessPolicy,
+        requestTransformations: transformations.map(cloneRequestTransformation),
+        forwardRules: inspection.forwardRules.map(cloneForwardRule),
+        currentPolicy: inspection.currentPolicy
+      });
+    });
+  }
+  addRequestTransformations(transformations) {
+    return __privateMethod(this, _VercelNetworkPolicyManager_instances, enqueueMutation_fn).call(this, async () => {
+      const inspection = __privateMethod(this, _VercelNetworkPolicyManager_instances, inspectPolicy_fn).call(this);
+      const incomingTransformations = transformations.map(
+        cloneRequestTransformation
+      );
+      if (__privateGet(this, _state) == null) {
+        const incomingPolicy = composeNetworkPolicy({
+          accessPolicy: inspection.accessPolicy,
+          requestTransformations: incomingTransformations,
+          forwardRules: inspection.forwardRules
+        });
+        const incomingHosts = getRequestTransformationHosts(incomingPolicy);
+        if (!isHostSetSubset({
+          subset: inspection.requestTransformationHosts,
+          superset: incomingHosts
+        })) {
+          throw createPolicyConflictError(
+            "Cannot add request transformations because the current Vercel Sandbox policy contains request transformations that cannot be attributed to this call. Their header values are redacted, so preserving them safely is not possible."
+          );
+        }
+      }
+      await __privateMethod(this, _VercelNetworkPolicyManager_instances, applyState_fn).call(this, {
+        accessPolicy: inspection.accessPolicy,
+        requestTransformations: __privateGet(this, _state) == null ? incomingTransformations : [
+          ...__privateGet(this, _state).requestTransformations.map(
+            cloneRequestTransformation
+          ),
+          ...incomingTransformations
+        ],
+        forwardRules: inspection.forwardRules.map(cloneForwardRule),
+        currentPolicy: inspection.currentPolicy
+      });
+    });
+  }
+};
+_sandbox = new WeakMap();
+_state = new WeakMap();
+_mutationQueue = new WeakMap();
+_VercelNetworkPolicyManager_instances = new WeakSet();
+enqueueMutation_fn = function(operation) {
+  const result = __privateGet(this, _mutationQueue).then(operation);
+  __privateSet(this, _mutationQueue, result.then(
+    () => void 0,
+    () => void 0
+  ));
+  return result;
+};
+inspectPolicy_fn = function() {
+  var _a;
+  if (__privateGet(this, _state) != null) {
+    return {
+      accessPolicy: __privateGet(this, _state).accessPolicy,
+      forwardRules: __privateGet(this, _state).forwardRules,
+      requestTransformationHosts: [],
+      currentPolicy: __privateGet(this, _state).effectivePolicy
+    };
+  }
+  return inspectCurrentPolicy(
+    (_a = __privateGet(this, _sandbox).currentSession().networkPolicy) != null ? _a : "allow-all"
+  );
+};
+applyState_fn = async function({
+  accessPolicy,
+  requestTransformations,
+  forwardRules,
+  currentPolicy
+}) {
+  const effectivePolicy = composeNetworkPolicy({
+    accessPolicy,
+    requestTransformations,
+    forwardRules
+  });
+  if (!areNetworkPoliciesEqual({
+    first: currentPolicy,
+    second: effectivePolicy
+  })) {
+    await __privateGet(this, _sandbox).update({ networkPolicy: effectivePolicy });
+  }
+  __privateSet(this, _state, {
+    accessPolicy: cloneNetworkAccessPolicy(accessPolicy),
+    requestTransformations: requestTransformations.map(
+      cloneRequestTransformation
+    ),
+    forwardRules: forwardRules.map(cloneForwardRule),
+    effectivePolicy
+  });
+};
+function inspectCurrentPolicy(policy) {
+  var _a, _b, _c, _d, _e;
+  if (policy === "allow-all" || policy === "deny-all") {
+    return {
+      accessPolicy: { mode: policy },
+      forwardRules: [],
+      requestTransformationHosts: [],
+      currentPolicy: policy
+    };
+  }
+  const allowedHosts = Array.isArray(policy.allow) ? [...policy.allow] : Object.keys((_a = policy.allow) != null ? _a : {});
+  const forwardRules = [];
+  const requestTransformationHosts = /* @__PURE__ */ new Set();
+  if (policy.allow != null && !Array.isArray(policy.allow)) {
+    for (const [host, rules] of Object.entries(policy.allow)) {
+      for (const rule of rules) {
+        if (hasRequestTransformation(rule)) {
+          requestTransformationHosts.add(host.toLowerCase());
+        }
+        if (rule.forwardURL != null) {
+          forwardRules.push({
+            host,
+            ...rule.match == null ? {} : { match: cloneMatch(rule.match) },
+            forwardURL: rule.forwardURL
+          });
+        }
+      }
+    }
+  }
+  return {
+    accessPolicy: {
+      mode: "custom",
+      allowedHosts: minimizeHostPatterns(allowedHosts),
+      allowedCIDRs: [...(_c = (_b = policy.subnets) == null ? void 0 : _b.allow) != null ? _c : []],
+      deniedCIDRs: [...(_e = (_d = policy.subnets) == null ? void 0 : _d.deny) != null ? _e : []]
+    },
+    forwardRules,
+    requestTransformationHosts: [...requestTransformationHosts],
+    currentPolicy: cloneNetworkPolicy(policy)
+  };
+}
+function toNetworkAccessPolicy(policy) {
+  var _a, _b, _c;
+  switch (policy.mode) {
+    case "allow-all":
+      return { mode: "allow-all" };
+    case "deny-all":
+      return { mode: "deny-all" };
+    case "custom": {
+      const allowedHosts = [...(_a = policy.allowedHosts) != null ? _a : []];
+      const allowedCIDRs = [...(_b = policy.allowedCIDRs) != null ? _b : []];
+      const deniedCIDRs = [...(_c = policy.deniedCIDRs) != null ? _c : []];
+      if (allowedHosts.length === 0 && allowedCIDRs.length === 0 && deniedCIDRs.length === 0) {
+        throw createPolicyConflictError(
+          "Custom network policy requires at least one of allowedHosts, allowedCIDRs, or deniedCIDRs to be non-empty."
+        );
+      }
+      return {
+        mode: "custom",
+        allowedHosts,
+        allowedCIDRs,
+        deniedCIDRs
+      };
+    }
+  }
+}
+function composeNetworkPolicy({
+  accessPolicy,
+  requestTransformations,
+  forwardRules
+}) {
+  if (accessPolicy.mode === "deny-all") {
+    return "deny-all";
+  }
+  const rulesByHost = /* @__PURE__ */ new Map();
+  const allowedHosts = accessPolicy.mode === "allow-all" ? ["*"] : accessPolicy.allowedHosts;
+  for (const host of allowedHosts) {
+    rulesByHost.set(host, []);
+  }
+  for (const transformation of requestTransformations) {
+    for (const host of getActiveHostPatterns({
+      allowedHosts,
+      ruleHost: transformation.match.host
+    })) {
+      appendRule({
+        rulesByHost,
+        host,
+        rule: toVercelRequestTransformationRule(transformation)
+      });
+    }
+  }
+  for (const forwardRule of forwardRules) {
+    for (const host of getActiveHostPatterns({
+      allowedHosts,
+      ruleHost: forwardRule.host
+    })) {
+      appendRule({
+        rulesByHost,
+        host,
+        rule: {
+          ...forwardRule.match == null ? {} : { match: cloneMatch(forwardRule.match) },
+          forwardURL: forwardRule.forwardURL
+        }
+      });
+    }
+  }
+  const hasActiveRules = [...rulesByHost.values()].some(
+    (rules) => rules.length > 0
+  );
+  if (!hasActiveRules) {
+    return toVercelAccessPolicy(accessPolicy);
+  }
+  return {
+    allow: Object.fromEntries(rulesByHost),
+    ...accessPolicy.mode !== "custom" ? {} : toVercelSubnets(accessPolicy)
+  };
+}
+function toVercelAccessPolicy(accessPolicy) {
+  if (accessPolicy.mode === "allow-all" || accessPolicy.mode === "deny-all") {
+    return accessPolicy.mode;
+  }
+  return {
+    ...accessPolicy.allowedHosts.length === 0 ? {} : { allow: [...accessPolicy.allowedHosts] },
+    ...toVercelSubnets(accessPolicy)
+  };
+}
+function toVercelSubnets(accessPolicy) {
+  if (accessPolicy.allowedCIDRs.length === 0 && accessPolicy.deniedCIDRs.length === 0) {
+    return {};
+  }
+  return {
+    subnets: {
+      ...accessPolicy.allowedCIDRs.length === 0 ? {} : { allow: [...accessPolicy.allowedCIDRs] },
+      ...accessPolicy.deniedCIDRs.length === 0 ? {} : { deny: [...accessPolicy.deniedCIDRs] }
+    }
+  };
+}
+function getActiveHostPatterns({
+  allowedHosts,
+  ruleHost
+}) {
+  return minimizeHostPatterns(
+    allowedHosts.flatMap((allowedHost) => {
+      const intersection = intersectHostPatterns({
+        first: allowedHost,
+        second: ruleHost
+      });
+      return intersection == null ? [] : [intersection];
+    })
+  );
+}
+function intersectHostPatterns({
+  first,
+  second
+}) {
+  if (isHostPatternSubset({ candidate: first, container: second })) {
+    return first;
+  }
+  if (isHostPatternSubset({ candidate: second, container: first })) {
+    return second;
+  }
+  return void 0;
+}
+function isHostPatternSubset({
+  candidate,
+  container
+}) {
+  const normalizedCandidate = candidate.toLowerCase();
+  const normalizedContainer = container.toLowerCase();
+  if (normalizedCandidate === normalizedContainer || normalizedContainer === "*") {
+    return true;
+  }
+  if (normalizedCandidate === "*" || !normalizedContainer.startsWith("*")) {
+    return false;
+  }
+  const containerSuffix = normalizedContainer.slice(1);
+  return normalizedCandidate.startsWith("*") ? normalizedCandidate.slice(1).endsWith(containerSuffix) : normalizedCandidate.endsWith(containerSuffix);
+}
+function minimizeHostPatterns(patterns) {
+  const uniquePatterns = [...new Set(patterns)];
+  return uniquePatterns.filter(
+    (pattern) => !uniquePatterns.some(
+      (other) => other !== pattern && isHostPatternSubset({ candidate: pattern, container: other })
+    )
+  );
+}
+function appendRule({
+  rulesByHost,
+  host,
+  rule
+}) {
+  var _a;
+  const rules = (_a = rulesByHost.get(host)) != null ? _a : [];
+  rules.push(rule);
+  rulesByHost.set(host, rules);
+}
+function toVercelRequestTransformationRule(transformation) {
+  const {
+    host: _host,
+    method,
+    path,
+    queryString,
+    headers
+  } = transformation.match;
+  const match = {
+    ...path == null ? {} : { path: cloneMatcher(path) },
+    ...method == null ? {} : { method: [...method] },
+    ...queryString == null ? {} : { queryString: queryString.map(cloneKeyValueMatcher) },
+    ...headers == null ? {} : { headers: headers.map(cloneKeyValueMatcher) }
+  };
+  return {
+    ...Object.keys(match).length === 0 ? {} : { match },
+    transform: [{ headers: { ...transformation.transform.headers } }]
+  };
+}
+function hasRequestTransformation(rule) {
+  var _a, _b;
+  return (_b = (_a = rule.transform) == null ? void 0 : _a.some(
+    (transformation) => transformation.headers != null && Object.keys(transformation.headers).length > 0
+  )) != null ? _b : false;
+}
+function getRequestTransformationHosts(policy) {
+  if (policy === "allow-all" || policy === "deny-all" || policy.allow == null || Array.isArray(policy.allow)) {
+    return [];
+  }
+  const hosts = /* @__PURE__ */ new Set();
+  for (const [host, rules] of Object.entries(policy.allow)) {
+    for (const rule of rules) {
+      if (hasRequestTransformation(rule)) {
+        hosts.add(host.toLowerCase());
+      }
+    }
+  }
+  return [...hosts];
+}
+function isHostSetSubset({
+  subset,
+  superset
+}) {
+  const allowedHosts = new Set(superset.map((host) => host.toLowerCase()));
+  return subset.every((host) => allowedHosts.has(host.toLowerCase()));
+}
+function areNetworkPoliciesEqual({
+  first,
+  second
+}) {
+  return stableSerialize(first) === stableSerialize(second);
+}
+function stableSerialize(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableSerialize).join(",")}]`;
+  }
+  if (value != null && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([firstKey], [secondKey]) => firstKey.localeCompare(secondKey)).map(
+      ([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`
+    ).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function cloneRequestTransformation(transformation) {
+  return {
+    match: {
+      host: transformation.match.host,
+      ...transformation.match.path == null ? {} : { path: cloneHarnessMatcher(transformation.match.path) },
+      ...transformation.match.method == null ? {} : { method: [...transformation.match.method] },
+      ...transformation.match.queryString == null ? {} : {
+        queryString: transformation.match.queryString.map(
+          cloneHarnessKeyValueMatcher
+        )
+      },
+      ...transformation.match.headers == null ? {} : {
+        headers: transformation.match.headers.map(
+          cloneHarnessKeyValueMatcher
+        )
+      }
+    },
+    transform: { headers: { ...transformation.transform.headers } }
+  };
+}
+function cloneForwardRule(rule) {
+  return {
+    host: rule.host,
+    ...rule.match == null ? {} : { match: cloneMatch(rule.match) },
+    forwardURL: rule.forwardURL
+  };
+}
+function cloneNetworkAccessPolicy(policy) {
+  if (policy.mode === "allow-all" || policy.mode === "deny-all") {
+    return { mode: policy.mode };
+  }
+  return {
+    mode: "custom",
+    allowedHosts: [...policy.allowedHosts],
+    allowedCIDRs: [...policy.allowedCIDRs],
+    deniedCIDRs: [...policy.deniedCIDRs]
+  };
+}
+function cloneNetworkPolicy(policy) {
+  if (policy === "allow-all" || policy === "deny-all") {
+    return policy;
+  }
+  return {
+    ...policy.allow == null ? {} : Array.isArray(policy.allow) ? { allow: [...policy.allow] } : {
+      allow: Object.fromEntries(
+        Object.entries(policy.allow).map(([host, rules]) => [
+          host,
+          rules.map((rule) => ({
+            ...rule.match == null ? {} : { match: cloneMatch(rule.match) },
+            ...rule.transform == null ? {} : {
+              transform: rule.transform.map((transform) => ({
+                ...transform.headers == null ? {} : { headers: { ...transform.headers } }
+              }))
+            },
+            ...rule.forwardURL == null ? {} : { forwardURL: rule.forwardURL }
+          }))
+        ])
+      )
+    },
+    ...policy.subnets == null ? {} : {
+      subnets: {
+        ...policy.subnets.allow == null ? {} : { allow: [...policy.subnets.allow] },
+        ...policy.subnets.deny == null ? {} : { deny: [...policy.subnets.deny] }
+      }
+    }
+  };
+}
+function cloneMatch(match) {
+  return {
+    ...match.path == null ? {} : { path: cloneMatcher(match.path) },
+    ...match.method == null ? {} : { method: [...match.method] },
+    ...match.queryString == null ? {} : { queryString: match.queryString.map(cloneKeyValueMatcher) },
+    ...match.headers == null ? {} : { headers: match.headers.map(cloneKeyValueMatcher) }
+  };
+}
+function cloneKeyValueMatcher(matcher) {
+  return {
+    ...matcher.key == null ? {} : { key: cloneMatcher(matcher.key) },
+    ...matcher.value == null ? {} : { value: cloneMatcher(matcher.value) }
+  };
+}
+function cloneMatcher(matcher) {
+  return { ...matcher };
+}
+function cloneHarnessKeyValueMatcher(matcher) {
+  return {
+    ...matcher.key == null ? {} : { key: cloneHarnessMatcher(matcher.key) },
+    ...matcher.value == null ? {} : { value: cloneHarnessMatcher(matcher.value) }
+  };
+}
+function cloneHarnessMatcher(matcher) {
+  if ("exact" in matcher) {
+    return { exact: matcher.exact };
+  }
+  if ("startsWith" in matcher) {
+    return { startsWith: matcher.startsWith };
+  }
+  return { regex: matcher.regex };
+}
+function createPolicyConflictError(message) {
+  return new HarnessCapabilityUnsupportedError({
+    harnessId: VERCEL_PROVIDER_ID,
+    message
+  });
+}
 
 // src/vercel-sandbox-session.ts
 import { posix } from "path";
@@ -233,16 +737,18 @@ function isFileNotFoundError(error) {
 }
 
 // src/vercel-network-sandbox-session.ts
-var VERCEL_PROVIDER_ID = "vercel-sandbox";
+var VERCEL_PROVIDER_ID2 = "vercel-sandbox";
+var _networkPolicyManager;
 var VercelNetworkSandboxSession = class extends VercelSandboxSession {
   constructor(input) {
     super(input.sandbox);
-    this.getPortUrl = async (options) => {
+    __privateAdd(this, _networkPolicyManager);
+    this.getPortEndpoint = async (options) => {
       var _a;
       const exposedPorts = this.ports;
       if (!exposedPorts.includes(options.port)) {
-        throw new HarnessCapabilityUnsupportedError({
-          harnessId: VERCEL_PROVIDER_ID,
+        throw new HarnessCapabilityUnsupportedError2({
+          harnessId: VERCEL_PROVIDER_ID2,
           message: `Port ${options.port} is not exposed on this sandbox. Exposed ports: [${exposedPorts.join(", ")}].`
         });
       }
@@ -260,10 +766,22 @@ var VercelNetworkSandboxSession = class extends VercelSandboxSession {
           url.protocol = isSecure ? "wss:" : "ws:";
           break;
       }
-      return url.toString();
+      return { url: url.toString() };
+    };
+    /**
+     * @deprecated Use `getPortEndpoint` instead.
+     */
+    this.getPortUrl = async (options) => {
+      return (await this.getPortEndpoint(options)).url;
     };
     this.setNetworkPolicy = async (policy) => {
-      await this.sandbox.update({ networkPolicy: toVercelPolicy(policy) });
+      await __privateGet(this, _networkPolicyManager).setNetworkPolicy(policy);
+    };
+    this.setRequestTransformations = async (transformations) => {
+      await __privateGet(this, _networkPolicyManager).setRequestTransformations(transformations);
+    };
+    this.addRequestTransformations = async (transformations) => {
+      await __privateGet(this, _networkPolicyManager).addRequestTransformations(transformations);
     };
     this.setPorts = async (ports, options) => {
       await this.sandbox.update(
@@ -284,6 +802,9 @@ var VercelNetworkSandboxSession = class extends VercelSandboxSession {
     this.ownsLifecycle = input.ownsLifecycle;
     this.id = input.sandbox.name;
     this.defaultWorkingDirectory = input.sandbox.currentSession().cwd;
+    __privateSet(this, _networkPolicyManager, new VercelNetworkPolicyManager({
+      sandbox: input.sandbox
+    }));
   }
   get ports() {
     return this.sandbox.routes.map((route) => route.port);
@@ -292,38 +813,11 @@ var VercelNetworkSandboxSession = class extends VercelSandboxSession {
     return new VercelSandboxSession(this.sandbox);
   }
 };
-function toVercelPolicy(policy) {
-  switch (policy.mode) {
-    case "allow-all":
-      return "allow-all";
-    case "deny-all":
-      return "deny-all";
-    case "custom": {
-      const result = {};
-      const { allowedHosts, allowedCIDRs, deniedCIDRs } = policy;
-      if (allowedHosts != null && allowedHosts.length > 0) {
-        result.allow = [...allowedHosts];
-      }
-      if (allowedCIDRs != null && allowedCIDRs.length > 0 || deniedCIDRs != null && deniedCIDRs.length > 0) {
-        result.subnets = {
-          ...allowedCIDRs != null && allowedCIDRs.length > 0 ? { allow: [...allowedCIDRs] } : {},
-          ...deniedCIDRs != null && deniedCIDRs.length > 0 ? { deny: [...deniedCIDRs] } : {}
-        };
-      }
-      if (result.allow == null && result.subnets == null) {
-        throw new HarnessCapabilityUnsupportedError({
-          harnessId: VERCEL_PROVIDER_ID,
-          message: "Custom network policy requires at least one of allowedHosts or allowedCIDRs to be non-empty."
-        });
-      }
-      return result;
-    }
-  }
-}
+_networkPolicyManager = new WeakMap();
 
 // src/vercel-sandbox.ts
 var DEFAULT_SANDBOX_TIMEOUT_MS = 30 * 60 * 1e3;
-var VERCEL_PROVIDER_ID2 = "vercel-sandbox";
+var VERCEL_PROVIDER_ID3 = "vercel-sandbox";
 var TEMPLATE_NAME_PREFIX = "ai-sdk-harness";
 var SESSION_NAME_PREFIX = "ai-sdk-harness-session";
 var SNAPSHOT_POLL_INTERVAL_MS = 500;
@@ -338,7 +832,7 @@ var VercelSandboxProvider = class {
   constructor(settings) {
     this.settings = settings;
     this.specificationVersion = "harness-sandbox-v1";
-    this.providerId = VERCEL_PROVIDER_ID2;
+    this.providerId = VERCEL_PROVIDER_ID3;
     this.createSession = async (options) => {
       var _a, _b, _c;
       (_a = options == null ? void 0 : options.abortSignal) == null ? void 0 : _a.throwIfAborted();
@@ -501,7 +995,7 @@ async function withVercelSandboxAuthenticationError({
     }
     throw new HarnessSandboxAuthenticationError({
       message: VERCEL_SANDBOX_AUTHENTICATION_MESSAGE,
-      sandboxProviderId: VERCEL_PROVIDER_ID2,
+      sandboxProviderId: VERCEL_PROVIDER_ID3,
       cause: error
     });
   }