@archildata/api-types 0.0.50 → 0.0.52

package/index.d.ts

@@ -841,13 +841,14 @@ export interface paths {
         /**
          * Set a sandbox's timeouts
          * @description Replaces one or both sandbox timeout settings. Updating `timeout` while
-         *     the sandbox is running resets its hard expiration deadline to that many
-         *     seconds from now. Updating `idle_ttl_seconds` resets the idle
-         *     countdown when no direct process connection is active; zero disables
-         *     idle expiry. Omitted settings remain unchanged. Updates are retained
-         *     across later stops and starts. For an inactive sandbox, they apply to
-         *     the next powered-on session. Sandboxes that are starting or shutting
-         *     down, or whose timeout changes concurrently, return 409.
+         *     the sandbox is running moves its hard expiration deadline to that many
+         *     seconds from now, but never past 24 hours after the session started.
+         *     Updating `idle_ttl_seconds` resets the idle countdown when no direct
+         *     process connection is active; zero disables idle expiry. Omitted
+         *     settings remain unchanged. Updates are retained across later stops and
+         *     starts. For an inactive sandbox, they apply to the next powered-on
+         *     session. Sandboxes that are starting or shutting down, or whose timeout
+         *     changes concurrently, return 409.
          */
         post: operations["setSandboxTimeout"];
         delete?: never;
@@ -1205,7 +1206,7 @@ export interface components {
         SandboxState: "pending" | "running" | "pausing" | "paused" | "stopping" | "stopped" | "exited" | "failed" | "deleting" | "deleted";
         /** @enum {string} */
         SandboxNetworkAction: "allow" | "deny";
-        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
+        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP port 80 is restricted to HTTP/1.1 or HTTP/2 and plaintext HTTP authority is enforced, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is relayed without TLS termination. With domain rules, it is evaluated by TLS SNI and connects to an address the runtime resolves for that name, never the address the guest dialed; names need a matching domain rule or default allow, and connections without a hostname SNI are denied. Only rules with header transformations or forwarding, and drain selectors, terminate TLS, which requires clients to trust the sandbox egress CA; for those, both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
         SandboxEgressPolicy: {
             default: components["schemas"]["SandboxNetworkAction"];
             /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, wildcard domains beginning with `*.`, or target objects with optional outbound HTTPS request transformations. A wildcard matches subdomains but not the apex domain, including when applying transformations. */
@@ -1241,7 +1242,7 @@ export interface components {
             egress?: components["schemas"]["SandboxEgressPolicy"];
         };
         SandboxTimeoutRequest: {
-            /** @description Seconds from now until a running sandbox expires, and the lifetime budget for its next powered-on session. */
+            /** @description Seconds from now until a running sandbox expires, capped at 24 hours after its session started, and the lifetime budget for its next powered-on session. */
             timeout?: number;
             /** @description Seconds without a direct process connection before the sandbox pauses. Zero disables idle expiry. */
             idle_ttl_seconds?: number;
@@ -1254,7 +1255,7 @@ export interface components {
             status: components["schemas"]["SandboxState"];
             vcpu_count: number;
             mem_size_mib: number;
-            /** @description Lifetime budget applied independently to each powered-on session. Expiry pauses the sandbox, preserving memory and processes for resume. Defaults to 24 hours and can be reset with the timeout endpoint. */
+            /** @description Lifetime budget applied independently to each powered-on session. Expiry pauses the sandbox, preserving memory and processes for resume. Defaults to 24 hours. The timeout endpoint can move the deadline, but no session runs longer than 24 hours. */
             max_ttl_seconds: number;
             /** @description Seconds without a direct process connection before the sandbox pauses, preserving memory and processes for resume. Zero disables idle expiry. */
             idle_ttl_seconds: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archildata/api-types",
-  "version": "0.0.50",
+  "version": "0.0.52",
   "description": "API types for the Archil control plane",
   "type": "module",
   "types": "index.d.ts",