@archildata/api-types 0.0.23 → 0.0.24

package/index.d.ts

@@ -590,14 +590,26 @@ export interface components {
         SandboxState: "pending" | "running" | "pausing" | "paused" | "stopping" | "stopped" | "exited" | "failed" | "deleting" | "deleted";
         /** @enum {string} */
         SandboxNetworkAction: "allow" | "deny";
-        /** @description Deny targets take precedence when an address or domain matches both lists. Domain rules inspect TLS SNI on TCP port 443 without terminating TLS. When domain rules are present, DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
+        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream and any request transformations. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
         SandboxEgressPolicy: {
             default: components["schemas"]["SandboxNetworkAction"];
-            /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, or wildcard domains beginning with `*.`. A wildcard matches subdomains but not the apex domain. */
-            allow?: string[];
+            /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, wildcard domains beginning with `*.`, or target objects with optional outbound HTTPS request transformations. A wildcard matches subdomains but not the apex domain. A target with effective transformations must be an exact lowercase domain. */
+            allow?: (string | components["schemas"]["SandboxEgressRule"])[];
             /** @description Denied IPv4 addresses, CIDR ranges, exact domains, or wildcard domains beginning with `*.`. A wildcard matches subdomains but not the apex domain. */
             deny?: string[];
         };
+        SandboxEgressRule: {
+            /** @description Target allowed by this rule. Must be an exact lowercase domain when effective transformations are present. */
+            target: string;
+            transform?: components["schemas"]["SandboxEgressTransform"];
+        };
+        /** @description Optional outbound HTTPS request transformations. An omitted or empty transform leaves the rule as an ordinary allow without request mutations. */
+        SandboxEgressTransform: {
+            /** @description Outbound HTTPS request headers to set, overwriting values supplied by the sandbox. */
+            headers?: {
+                [key: string]: string;
+            };
+        };
         /** @description Sandbox network policy. Egress is unrestricted when omitted. */
         SandboxNetwork: {
             egress?: components["schemas"]["SandboxEgressPolicy"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archildata/api-types",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "API types for the Archil control plane",
   "type": "module",
   "types": "index.d.ts",