@archildata/api-types 0.0.23 → 0.0.25

package/index.d.ts

@@ -485,6 +485,35 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/sandboxes/{sid}/network": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Get a sandbox's network policy
+         * @description Returns the last committed network policy for a running, paused, or stopped sandbox.
+         */
+        get: operations["getSandboxNetwork"];
+        /**
+         * Replace a running sandbox's network policy
+         * @description Applies the complete replacement policy to a running sandbox, then
+         *     records it as the current policy. A rejected update leaves the previous
+         *     policy unchanged. An empty object restores unrestricted egress. Existing
+         *     network sessions are not terminated; the replacement governs new
+         *     connections and is retained across later stops and resumes. Sandboxes
+         *     that are not running, or whose policy changes concurrently, return 409.
+         */
+        put: operations["updateSandboxNetwork"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/sandboxes/{sid}/start": {
         parameters: {
             query?: never;
@@ -590,14 +619,26 @@ export interface components {
         SandboxState: "pending" | "running" | "pausing" | "paused" | "stopping" | "stopped" | "exited" | "failed" | "deleting" | "deleted";
         /** @enum {string} */
         SandboxNetworkAction: "allow" | "deny";
-        /** @description Deny targets take precedence when an address or domain matches both lists. Domain rules inspect TLS SNI on TCP port 443 without terminating TLS. When domain rules are present, DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
+        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream and any request transformations. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
         SandboxEgressPolicy: {
             default: components["schemas"]["SandboxNetworkAction"];
-            /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, or wildcard domains beginning with `*.`. A wildcard matches subdomains but not the apex domain. */
-            allow?: string[];
+            /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, wildcard domains beginning with `*.`, or target objects with optional outbound HTTPS request transformations. A wildcard matches subdomains but not the apex domain. A target with effective transformations must be an exact lowercase domain. */
+            allow?: (string | components["schemas"]["SandboxEgressRule"])[];
             /** @description Denied IPv4 addresses, CIDR ranges, exact domains, or wildcard domains beginning with `*.`. A wildcard matches subdomains but not the apex domain. */
             deny?: string[];
         };
+        SandboxEgressRule: {
+            /** @description Target allowed by this rule. Must be an exact lowercase domain when effective transformations are present. */
+            target: string;
+            transform?: components["schemas"]["SandboxEgressTransform"];
+        };
+        /** @description Optional outbound HTTPS request transformations. An omitted or empty transform leaves the rule as an ordinary allow without request mutations. */
+        SandboxEgressTransform: {
+            /** @description Outbound HTTPS request headers to set, overwriting values supplied by the sandbox. */
+            headers?: {
+                [key: string]: string;
+            };
+        };
         /** @description Sandbox network policy. Egress is unrestricted when omitted. */
         SandboxNetwork: {
             egress?: components["schemas"]["SandboxEgressPolicy"];
@@ -622,7 +663,6 @@ export interface components {
              */
             platform?: "arm64" | "amd64";
             endpoints?: components["schemas"]["SandboxEndpoint"][];
-            network?: components["schemas"]["SandboxNetwork"];
             /** Format: date-time */
             created_at: string;
             /** Format: date-time */
@@ -663,6 +703,11 @@ export interface components {
             success: boolean;
             data: components["schemas"]["Sandbox"];
         };
+        ApiResponse_SandboxNetwork: {
+            /** @example true */
+            success: boolean;
+            data: components["schemas"]["SandboxNetwork"];
+        };
         CreateSandboxRequest: {
             /** @description Sandbox name, unique within the account. A random word-list name is generated when omitted. */
             name?: string;
@@ -2473,6 +2518,74 @@ export interface operations {
             503: components["responses"]["RetryableUnavailable"];
         };
     };
+    getSandboxNetwork: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Sandbox UUID */
+                sid: components["parameters"]["SandboxId"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The last committed network policy */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_SandboxNetwork"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            500: components["responses"]["InternalError"];
+            503: components["responses"]["RetryableUnavailable"];
+        };
+    };
+    updateSandboxNetwork: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Sandbox UUID */
+                sid: components["parameters"]["SandboxId"];
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SandboxNetwork"];
+            };
+        };
+        responses: {
+            /** @description The network policy was replaced */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ApiResponse_SandboxNetwork"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+            /** @description The sandbox is not running or the network policy changed concurrently */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
+            500: components["responses"]["InternalError"];
+            503: components["responses"]["RetryableUnavailable"];
+        };
+    };
     startSandbox: {
         parameters: {
             query?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archildata/api-types",
-  "version": "0.0.23",
+  "version": "0.0.25",
   "description": "API types for the Archil control plane",
   "type": "module",
   "types": "index.d.ts",